security requirements extraction

The problem

Security goals often stall because they are stated as vague aspirations rather than actionable engineering tasks. Developers and architects struggle to translate high-level threat models or compliance mandates into specific, testable requirements that fit into a sprint.

What it does

• Converts threat models and risk scenarios into granular, traceable security requirements.
• Generates security-focused user stories with explicit acceptance criteria for engineering teams.
• Builds validation methods and test cases directly from architectural constraints or control gaps.
• Maps requirements to supplied compliance frameworks or internal policies without inventing data.
• Classifies requirements by type: functional, non-functional, process, or assurance.

Why this beats prompting it yourself

Generic prompts often return broad security advice like "use encryption." This skill enforces a strict schema that includes rationale, evidence requirements, and measurable validation methods for every entry. It prevents the hallucination of framework clauses and ensures every requirement is tied to a specific source driver.

Use cases

• Transforming a STRIDE threat model into a prioritized product backlog.
• Deriving acceptance criteria for a new identity service based on internal auth policies.
• Generating a security assurance checklist for a third-party vendor integration.
• Creating testable security stories for a cloud migration project.

Known limitations

Does not provide offensive exploit instructions or bypass methods. Requires the user to provide the specific frameworks or policies for mapping as it will not invent external control text.