[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M70KCQEBQ5X7PVB2BH8NB7B5":3,"skill-same:01M70KCQEBQ5X7PVB2BH8NB7B5":70},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":49,"repositoryHtmlUrl":50,"repositoryHomepageUrl":51,"ownerHtmlUrl":52,"ownerBlogUrl":53,"ownerDescription":54,"updatedAt":55,"install":56,"resources":69},"01M70KCQEBQ5X7PVB2BH8NB7B5","security-requirement-extraction",null,"Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.","shengdabai\u002FTony-Claude-Code-Skills","shengdabai","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F116417419?v=4","01M70F6D2WY5PQV5A92BKYJQEW","Tony Sheng","01M70F6D3GAAAYZ5H4CC1G8VXM",3,"MIT","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fwshobson-agents\u002Fplugins\u002Fsecurity-scanning\u002Fskills\u002Fsecurity-requirement-extraction\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000031","产品经理","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"security","extraction","security requirement extraction","context","user","user stories","test cases","threat","security test","models","test","stories","requirements","when","business","use","actionable","2026-11-10 10:12:30",false,"---\nname: security-requirement-extraction\ndescription: Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.\n---\n\n# Security Requirement Extraction\n\nTransform threat analysis into actionable security requirements.\n\n## When to Use This Skill\n\n- Converting threat models to requirements\n- Writing security user stories\n- Creating security test cases\n- Building security acceptance criteria\n- Compliance requirement mapping\n- Security architecture documentation\n\n## Core Concepts\n\n### 1. Requirement Categories\n\n```\nBusiness Requirements → Security Requirements → Technical Controls\n         ↓                       ↓                      ↓\n  \"Protect customer    \"Encrypt PII at rest\"   \"AES-256 encryption\n   data\"                                        with KMS key rotation\"\n```\n\n### 2. Security Requirement Types\n\n| Type | Focus | Example |\n|------|-------|---------|\n| **Functional** | What system must do | \"System must authenticate users\" |\n| **Non-functional** | How system must perform | \"Authentication must complete in \u003C2s\" |\n| **Constraint** | Limitations imposed | \"Must use approved crypto libraries\" |\n\n### 3. Requirement Attributes\n\n| Attribute | Description |\n|-----------|-------------|\n| **Traceability** | Links to threats\u002Fcompliance |\n| **Testability** | Can be verified |\n| **Priority** | Business importance |\n| **Risk Level** | Impact if not met |\n\n## Templates\n\n### Template 1: Security Requirement Model\n\n```python\nfrom dataclasses import dataclass, field\nfrom enum import Enum\nfrom typing import List, Dict, Optional, Set\nfrom datetime import datetime\n\nclass RequirementType(Enum):\n    FUNCTIONAL = \"functional\"\n    NON_FUNCTIONAL = \"non_functional\"\n    CONSTRAINT = \"constraint\"\n\n\nclass Priority(Enum):\n    CRITICAL = 1\n    HIGH = 2\n    MEDIUM = 3\n    LOW = 4\n\n\nclass SecurityDomain(Enum):\n    AUTHENTICATION = \"authentication\"\n    AUTHORIZATION = \"authorization\"\n    DATA_PROTECTION = \"data_protection\"\n    AUDIT_LOGGING = \"audit_logging\"\n    INPUT_VALIDATION = \"input_validation\"\n    ERROR_HANDLING = \"error_handling\"\n    SESSION_MANAGEMENT = \"session_management\"\n    CRYPTOGRAPHY = \"cryptography\"\n    NETWORK_SECURITY = \"network_security\"\n    AVAILABILITY = \"availability\"\n\n\nclass ComplianceFramework(Enum):\n    PCI_DSS = \"pci_dss\"\n    HIPAA = \"hipaa\"\n    GDPR = \"gdpr\"\n    SOC2 = \"soc2\"\n    NIST_CSF = \"nist_csf\"\n    ISO_27001 = \"iso_27001\"\n    OWASP = \"owasp\"\n\n\n@dataclass\nclass SecurityRequirement:\n    id: str\n    title: str\n    description: str\n    req_type: RequirementType\n    domain: SecurityDomain\n    priority: Priority\n    rationale: str = \"\"\n    acceptance_criteria: List[str] = field(default_factory=list)\n    test_cases: List[str] = field(default_factory=list)\n    threat_refs: List[str] = field(default_factory=list)\n    compliance_refs: List[str] = field(default_factory=list)\n    dependencies: List[str] = field(default_factory=list)\n    status: str = \"draft\"\n    owner: str = \"\"\n    created_date: datetime = field(default_factory=datetime.now)\n\n    def to_user_story(self) -> str:\n        \"\"\"Convert to user story format.\"\"\"\n        return f\"\"\"\n**{self.id}: {self.title}**\n\nAs a security-conscious system,\nI need to {self.description.lower()},\nSo that {self.rationale.lower()}.\n\n**Acceptance Criteria:**\n{chr(10).join(f'- [ ] {ac}' for ac in self.acceptance_criteria)}\n\n**Priority:** {self.priority.name}\n**Domain:** {self.domain.value}\n**Threat References:** {', '.join(self.threat_refs)}\n\"\"\"\n\n    def to_test_spec(self) -> str:\n        \"\"\"Convert to test specification.\"\"\"\n        return f\"\"\"\n## Test Specification: {self.id}\n\n### Requirement\n{self.description}\n\n### Test Cases\n{chr(10).join(f'{i+1}. {tc}' for i, tc in enumerate(self.test_cases))}\n\n### Acceptance Criteria Verification\n{chr(10).join(f'- {ac}' for ac in self.acceptance_criteria)}\n\"\"\"\n\n\n@dataclass\nclass RequirementSet:\n    name: str\n    version: str\n    requirements: List[SecurityRequirement] = field(default_factory=list)\n\n    def add(self, req: SecurityRequirement) -> None:\n        self.requirements.append(req)\n\n    def get_by_domain(self, domain: SecurityDomain) -> List[SecurityRequirement]:\n        return [r for r in self.requirements if r.domain == domain]\n\n    def get_by_priority(self, priority: Priority) -> List[SecurityRequirement]:\n        return [r for r in self.requirements if r.priority == priority]\n\n    def get_by_threat(self, threat_id: str) -> List[SecurityRequirement]:\n        return [r for r in self.requirements if threat_id in r.threat_refs]\n\n    def get_critical_requirements(self) -> List[SecurityRequirement]:\n        return [r for r in self.requirements if r.priority == Priority.CRITICAL]\n\n    def export_markdown(self) -> str:\n        \"\"\"Export all requirements as markdown.\"\"\"\n        lines = [f\"# Security Requirements: {self.name}\\n\"]\n        lines.append(f\"Version: {self.version}\\n\")\n\n        for domain in SecurityDomain:\n            domain_reqs = self.get_by_domain(domain)\n            if domain_reqs:\n                lines.append(f\"\\n## {domain.value.replace('_', ' ').title()}\\n\")\n                for req in domain_reqs:\n                    lines.append(req.to_user_story())\n\n        return \"\\n\".join(lines)\n\n    def traceability_matrix(self) -> Dict[str, List[str]]:\n        \"\"\"Generate threat-to-requirement traceability.\"\"\"\n        matrix = {}\n        for req in self.requirements:\n            for threat_id in req.threat_refs:\n                if threat_id not in matrix:\n                    matrix[threat_id] = []\n                matrix[threat_id].append(req.id)\n        return matrix\n```\n\n### Template 2: Threat-to-Requirement Extractor\n\n```python\nfrom dataclasses import dataclass\nfrom typing import List, Dict, Tuple\n\n@dataclass\nclass ThreatInput:\n    id: str\n    category: str  # STRIDE category\n    title: str\n    description: str\n    target: str\n    impact: str\n    likelihood: str\n\n\nclass RequirementExtractor:\n    \"\"\"Extract security requirements from threats.\"\"\"\n\n    # Mapping of STRIDE categories to security domains and requirement patterns\n    STRIDE_MAPPINGS = {\n        \"SPOOFING\": {\n            \"domains\": [SecurityDomain.AUTHENTICATION, SecurityDomain.SESSION_MANAGEMENT],\n            \"patterns\": [\n                (\"Implement strong authentication for {target}\",\n                 \"Ensure {target} authenticates all users before granting access\"),\n                (\"Validate identity tokens for {target}\",\n                 \"All authentication tokens must be cryptographically verified\"),\n                (\"Implement session management for {target}\",\n                 \"Sessions must be securely managed with proper expiration\"),\n            ]\n        },\n        \"TAMPERING\": {\n            \"domains\": [SecurityDomain.INPUT_VALIDATION, SecurityDomain.DATA_PROTECTION],\n            \"patterns\": [\n                (\"Validate all input to {target}\",\n                 \"All input must be validated against expected formats\"),\n                (\"Implement integrity checks for {target}\",\n                 \"Data integrity must be verified using cryptographic signatures\"),\n                (\"Protect {target} from modification\",\n                 \"Implement controls to prevent unauthorized data modification\"),\n            ]\n        },\n        \"REPUDIATION\": {\n            \"domains\": [SecurityDomain.AUDIT_LOGGING],\n            \"patterns\": [\n                (\"Log all security events for {target}\",\n                 \"Security-relevant events must be logged for audit purposes\"),\n                (\"Implement non-repudiation for {target}\",\n                 \"Critical actions must have cryptographic proof of origin\"),\n                (\"Protect audit logs for {target}\",\n                 \"Audit logs must be tamper-evident and protected\"),\n            ]\n        },\n        \"INFORMATION_DISCLOSURE\": {\n            \"domains\": [SecurityDomain.DATA_PROTECTION, SecurityDomain.CRYPTOGRAPHY],\n            \"patterns\": [\n                (\"Encrypt sensitive data in {target}\",\n                 \"Sensitive data must be encrypted at rest and in transit\"),\n                (\"Implement access controls for {target}\",\n                 \"Data access must be restricted based on need-to-know\"),\n                (\"Prevent information leakage from {target}\",\n                 \"Error messages and logs must not expose sensitive information\"),\n            ]\n        },\n        \"DENIAL_OF_SERVICE\": {\n            \"domains\": [SecurityDomain.AVAILABILITY, SecurityDomain.INPUT_VALIDATION],\n            \"patterns\": [\n                (\"Implement rate limiting for {target}\",\n                 \"Requests must be rate-limited to prevent resource exhaustion\"),\n                (\"Ensure availability of {target}\",\n                 \"System must remain available under high load conditions\"),\n                (\"Implement resource quotas for {target}\",\n                 \"Resource consumption must be bounded and monitored\"),\n            ]\n        },\n        \"ELEVATION_OF_PRIVILEGE\": {\n            \"domains\": [SecurityDomain.AUTHORIZATION],\n            \"patterns\": [\n                (\"Enforce authorization for {target}\",\n                 \"All actions must be authorized based on user permissions\"),\n                (\"Implement least privilege for {target}\",\n                 \"Users must only have minimum necessary permissions\"),\n                (\"Validate permissions for {target}\",\n                 \"Permission checks must be performed server-side\"),\n            ]\n        },\n    }\n\n    def extract_requirements(\n        self,\n        threats: List[ThreatInput],\n        project_name: str\n    ) -> RequirementSet:\n        \"\"\"Extract security requirements from threats.\"\"\"\n        req_set = RequirementSet(\n            name=f\"{project_name} Security Requirements\",\n            version=\"1.0\"\n        )\n\n        req_counter = 1\n        for threat in threats:\n            reqs = self._threat_to_requirements(threat, req_counter)\n            for req in reqs:\n                req_set.add(req)\n            req_counter += len(reqs)\n\n        return req_set\n\n    def _threat_to_requirements(\n        self,\n        threat: ThreatInput,\n        start_id: int\n    ) -> List[SecurityRequirement]:\n        \"\"\"Convert a single threat to requirements.\"\"\"\n        requirements = []\n        mapping = self.STRIDE_MAPPINGS.get(threat.category, {})\n        domains = mapping.get(\"domains\", [])\n        patterns = mapping.get(\"patterns\", [])\n\n        priority = self._calculate_priority(threat.impact, threat.likelihood)\n\n        for i, (title_pattern, desc_pattern) in enumerate(patterns):\n            req = SecurityRequirement(\n                id=f\"SR-{start_id + i:03d}\",\n                title=title_pattern.format(target=threat.target),\n                description=desc_pattern.format(target=threat.target),\n                req_type=RequirementType.FUNCTIONAL,\n                domain=domains[i % len(domains)] if domains else SecurityDomain.DATA_PROTECTION,\n                priority=priority,\n                rationale=f\"Mitigates threat: {threat.title}\",\n                threat_refs=[threat.id],\n                acceptance_criteria=self._generate_acceptance_criteria(\n                    threat.category, threat.target\n                ),\n                test_cases=self._generate_test_cases(\n                    threat.category, threat.target\n                )\n            )\n            requirements.append(req)\n\n        return requirements\n\n    def _calculate_priority(self, impact: str, likelihood: str) -> Priority:\n        \"\"\"Calculate requirement priority from threat attributes.\"\"\"\n        score_map = {\"LOW\": 1, \"MEDIUM\": 2, \"HIGH\": 3, \"CRITICAL\": 4}\n        impact_score = score_map.get(impact.upper(), 2)\n        likelihood_score = score_map.get(likelihood.upper(), 2)\n\n        combined = impact_score * likelihood_score\n\n        if combined >= 12:\n            return Priority.CRITICAL\n        elif combined >= 6:\n            return Priority.HIGH\n        elif combined >= 3:\n            return Priority.MEDIUM\n        return Priority.LOW\n\n    def _generate_acceptance_criteria(\n        self,\n        category: str,\n        target: str\n    ) -> List[str]:\n        \"\"\"Generate acceptance criteria for requirement.\"\"\"\n        criteria_templates = {\n            \"SPOOFING\": [\n                f\"Users must authenticate before accessing {target}\",\n                \"Authentication failures are logged and monitored\",\n                \"Multi-factor authentication is available for sensitive operations\",\n            ],\n            \"TAMPERING\": [\n                f\"All input to {target} is validated\",\n                \"Data integrity is verified before processing\",\n                \"Modification attempts trigger alerts\",\n            ],\n            \"REPUDIATION\": [\n                f\"All actions on {target} are logged with user identity\",\n                \"Logs cannot be modified by regular users\",\n                \"Log retention meets compliance requirements\",\n            ],\n            \"INFORMATION_DISCLOSURE\": [\n                f\"Sensitive data in {target} is encrypted\",\n                \"Access to sensitive data is logged\",\n                \"Error messages do not reveal sensitive information\",\n            ],\n            \"DENIAL_OF_SERVICE\": [\n                f\"Rate limiting is enforced on {target}\",\n                \"System degrades gracefully under load\",\n                \"Resource exhaustion triggers alerts\",\n            ],\n            \"ELEVATION_OF_PRIVILEGE\": [\n                f\"Authorization is checked for all {target} operations\",\n                \"Users cannot access resources beyond their permissions\",\n                \"Privilege changes are logged and monitored\",\n            ],\n        }\n        return criteria_templates.get(category, [])\n\n    def _generate_test_cases(\n        self,\n        category: str,\n        target: str\n    ) -> List[str]:\n        \"\"\"Generate test cases for requirement.\"\"\"\n        test_templates = {\n            \"SPOOFING\": [\n                f\"Test: Unauthenticated access to {target} is denied\",\n                \"Test: Invalid credentials are rejected\",\n                \"Test: Session tokens cannot be forged\",\n            ],\n            \"TAMPERING\": [\n                f\"Test: Invalid input to {target} is rejected\",\n                \"Test: Tampered data is detected and rejected\",\n                \"Test: SQL injection attempts are blocked\",\n            ],\n            \"REPUDIATION\": [\n                \"Test: Security events are logged\",\n                \"Test: Logs include sufficient detail for forensics\",\n                \"Test: Log integrity is protected\",\n            ],\n            \"INFORMATION_DISCLOSURE\": [\n                f\"Test: {target} data is encrypted in transit\",\n                f\"Test: {target} data is encrypted at rest\",\n                \"Test: Error messages are sanitized\",\n            ],\n            \"DENIAL_OF_SERVICE\": [\n                f\"Test: Rate limiting on {target} works correctly\",\n                \"Test: System handles burst traffic gracefully\",\n                \"Test: Resource limits are enforced\",\n            ],\n            \"ELEVATION_OF_PRIVILEGE\": [\n                f\"Test: Unauthorized access to {target} is denied\",\n                \"Test: Privilege escalation attempts are blocked\",\n                \"Test: IDOR vulnerabilities are not present\",\n            ],\n        }\n        return test_templates.get(category, [])\n```\n\n### Template 3: Compliance Mapping\n\n```python\nfrom typing import Dict, List, Set\n\nclass ComplianceMapper:\n    \"\"\"Map security requirements to compliance frameworks.\"\"\"\n\n    FRAMEWORK_CONTROLS = {\n        ComplianceFramework.PCI_DSS: {\n            SecurityDomain.AUTHENTICATION: [\"8.1\", \"8.2\", \"8.3\"],\n            SecurityDomain.AUTHORIZATION: [\"7.1\", \"7.2\"],\n            SecurityDomain.DATA_PROTECTION: [\"3.4\", \"3.5\", \"4.1\"],\n            SecurityDomain.AUDIT_LOGGING: [\"10.1\", \"10.2\", \"10.3\"],\n            SecurityDomain.NETWORK_SECURITY: [\"1.1\", \"1.2\", \"1.3\"],\n            SecurityDomain.CRYPTOGRAPHY: [\"3.5\", \"3.6\", \"4.1\"],\n        },\n        ComplianceFramework.HIPAA: {\n            SecurityDomain.AUTHENTICATION: [\"164.312(d)\"],\n            SecurityDomain.AUTHORIZATION: [\"164.312(a)(1)\"],\n            SecurityDomain.DATA_PROTECTION: [\"164.312(a)(2)(iv)\", \"164.312(e)(2)(ii)\"],\n            SecurityDomain.AUDIT_LOGGING: [\"164.312(b)\"],\n        },\n        ComplianceFramework.GDPR: {\n            SecurityDomain.DATA_PROTECTION: [\"Art. 32\", \"Art. 25\"],\n            SecurityDomain.AUDIT_LOGGING: [\"Art. 30\"],\n            SecurityDomain.AUTHORIZATION: [\"Art. 25\"],\n        },\n        ComplianceFramework.OWASP: {\n            SecurityDomain.AUTHENTICATION: [\"V2.1\", \"V2.2\", \"V2.3\"],\n            SecurityDomain.SESSION_MANAGEMENT: [\"V3.1\", \"V3.2\", \"V3.3\"],\n            SecurityDomain.INPUT_VALIDATION: [\"V5.1\", \"V5.2\", \"V5.3\"],\n            SecurityDomain.CRYPTOGRAPHY: [\"V6.1\", \"V6.2\"],\n            SecurityDomain.ERROR_HANDLING: [\"V7.1\", \"V7.2\"],\n            SecurityDomain.DATA_PROTECTION: [\"V8.1\", \"V8.2\", \"V8.3\"],\n            SecurityDomain.AUDIT_LOGGING: [\"V7.1\", \"V7.2\"],\n        },\n    }\n\n    def map_requirement_to_compliance(\n        self,\n        requirement: SecurityRequirement,\n        frameworks: List[ComplianceFramework]\n    ) -> Dict[str, List[str]]:\n        \"\"\"Map a requirement to compliance controls.\"\"\"\n        mapping = {}\n        for framework in frameworks:\n            controls = self.FRAMEWORK_CONTROLS.get(framework, {})\n            domain_controls = controls.get(requirement.domain, [])\n            if domain_controls:\n                mapping[framework.value] = domain_controls\n        return mapping\n\n    def get_requirements_for_control(\n        self,\n        requirement_set: RequirementSet,\n        framework: ComplianceFramework,\n        control_id: str\n    ) -> List[SecurityRequirement]:\n        \"\"\"Find requirements that satisfy a compliance control.\"\"\"\n        matching = []\n        framework_controls = self.FRAMEWORK_CONTROLS.get(framework, {})\n\n        for domain, controls in framework_controls.items():\n            if control_id in controls:\n                matching.extend(requirement_set.get_by_domain(domain))\n\n        return matching\n\n    def generate_compliance_matrix(\n        self,\n        requirement_set: RequirementSet,\n        frameworks: List[ComplianceFramework]\n    ) -> Dict[str, Dict[str, List[str]]]:\n        \"\"\"Generate compliance traceability matrix.\"\"\"\n        matrix = {}\n\n        for framework in frameworks:\n            matrix[framework.value] = {}\n            framework_controls = self.FRAMEWORK_CONTROLS.get(framework, {})\n\n            for domain, controls in framework_controls.items():\n                for control in controls:\n                    reqs = self.get_requirements_for_control(\n                        requirement_set, framework, control\n                    )\n                    if reqs:\n                        matrix[framework.value][control] = [r.id for r in reqs]\n\n        return matrix\n\n    def gap_analysis(\n        self,\n        requirement_set: RequirementSet,\n        framework: ComplianceFramework\n    ) -> Dict[str, List[str]]:\n        \"\"\"Identify compliance gaps.\"\"\"\n        gaps = {\"missing_controls\": [], \"weak_coverage\": []}\n        framework_controls = self.FRAMEWORK_CONTROLS.get(framework, {})\n\n        for domain, controls in framework_controls.items():\n            domain_reqs = requirement_set.get_by_domain(domain)\n            for control in controls:\n                matching = self.get_requirements_for_control(\n                    requirement_set, framework, control\n                )\n                if not matching:\n                    gaps[\"missing_controls\"].append(f\"{framework.value}:{control}\")\n                elif len(matching) \u003C 2:\n                    gaps[\"weak_coverage\"].append(f\"{framework.value}:{control}\")\n\n        return gaps\n```\n\n### Template 4: Security User Story Generator\n\n```python\nclass SecurityUserStoryGenerator:\n    \"\"\"Generate security-focused user stories.\"\"\"\n\n    STORY_TEMPLATES = {\n        SecurityDomain.AUTHENTICATION: {\n            \"as_a\": \"security-conscious user\",\n            \"so_that\": \"my identity is protected from impersonation\",\n        },\n        SecurityDomain.AUTHORIZATION: {\n            \"as_a\": \"system administrator\",\n            \"so_that\": \"users can only access resources appropriate to their role\",\n        },\n        SecurityDomain.DATA_PROTECTION: {\n            \"as_a\": \"data owner\",\n            \"so_that\": \"my sensitive information remains confidential\",\n        },\n        SecurityDomain.AUDIT_LOGGING: {\n            \"as_a\": \"security analyst\",\n            \"so_that\": \"I can investigate security incidents\",\n        },\n        SecurityDomain.INPUT_VALIDATION: {\n            \"as_a\": \"application developer\",\n            \"so_that\": \"the system is protected from malicious input\",\n        },\n    }\n\n    def generate_story(self, requirement: SecurityRequirement) -> str:\n        \"\"\"Generate a user story from requirement.\"\"\"\n        template = self.STORY_TEMPLATES.get(\n            requirement.domain,\n            {\"as_a\": \"user\", \"so_that\": \"the system is secure\"}\n        )\n\n        story = f\"\"\"\n## {requirement.id}: {requirement.title}\n\n**User Story:**\nAs a {template['as_a']},\nI want the system to {requirement.description.lower()},\nSo that {template['so_that']}.\n\n**Priority:** {requirement.priority.name}\n**Type:** {requirement.req_type.value}\n**Domain:** {requirement.domain.value}\n\n**Acceptance Criteria:**\n{self._format_acceptance_criteria(requirement.acceptance_criteria)}\n\n**Definition of Done:**\n- [ ] Implementation complete\n- [ ] Security tests pass\n- [ ] Code review complete\n- [ ] Security review approved\n- [ ] Documentation updated\n\n**Security Test Cases:**\n{self._format_test_cases(requirement.test_cases)}\n\n**Traceability:**\n- Threats: {', '.join(requirement.threat_refs) or 'N\u002FA'}\n- Compliance: {', '.join(requirement.compliance_refs) or 'N\u002FA'}\n\"\"\"\n        return story\n\n    def _format_acceptance_criteria(self, criteria: List[str]) -> str:\n        return \"\\n\".join(f\"- [ ] {c}\" for c in criteria) if criteria else \"- [ ] TBD\"\n\n    def _format_test_cases(self, tests: List[str]) -> str:\n        return \"\\n\".join(f\"- {t}\" for t in tests) if tests else \"- TBD\"\n\n    def generate_epic(\n        self,\n        requirement_set: RequirementSet,\n        domain: SecurityDomain\n    ) -> str:\n        \"\"\"Generate an epic for a security domain.\"\"\"\n        reqs = requirement_set.get_by_domain(domain)\n\n        epic = f\"\"\"\n# Security Epic: {domain.value.replace('_', ' ').title()}\n\n## Overview\nThis epic covers all security requirements related to {domain.value.replace('_', ' ')}.\n\n## Business Value\n- Protect against {domain.value.replace('_', ' ')} related threats\n- Meet compliance requirements\n- Reduce security risk\n\n## Stories in this Epic\n{chr(10).join(f'- [{r.id}] {r.title}' for r in reqs)}\n\n## Acceptance Criteria\n- All stories complete\n- Security tests passing\n- Security review approved\n- Compliance requirements met\n\n## Risk if Not Implemented\n- Vulnerability to {domain.value.replace('_', ' ')} attacks\n- Compliance violations\n- Potential data breach\n\n## Dependencies\n{chr(10).join(f'- {d}' for r in reqs for d in r.dependencies) or '- None identified'}\n\"\"\"\n        return epic\n```\n\n## Best Practices\n\n### Do's\n- **Trace to threats** - Every requirement should map to threats\n- **Be specific** - Vague requirements can't be tested\n- **Include acceptance criteria** - Define \"done\"\n- **Consider compliance** - Map to frameworks early\n- **Review regularly** - Requirements evolve with threats\n\n### Don'ts\n- **Don't be generic** - \"Be secure\" is not a requirement\n- **Don't skip rationale** - Explain why it matters\n- **Don't ignore priorities** - Not all requirements are equal\n- **Don't forget testability** - If you can't test it, you can't verify it\n- **Don't work in isolation** - Involve stakeholders\n\n## Resources\n\n- [OWASP ASVS](https:\u002F\u002Fowasp.org\u002Fwww-project-application-security-verification-standard\u002F)\n- [NIST SP 800-53](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-53\u002Frev-5\u002Ffinal)\n- [Security User Stories](https:\u002F\u002Fwww.oreilly.com\u002Flibrary\u002Fview\u002Fagile-application-security\u002F9781491938836\u002F)\n","# Security Requirement Extraction\n\nTransform threat analysis into actionable security requirements.\n\n## When to Use This Skill\n\n- Converting threat models to requirements\n- Writing security user stories\n- Creating security test cases\n- Building security acceptance criteria\n- Compliance requirement mapping\n- Security architecture documentation\n\n## Core Concepts\n\n### 1. Requirement Categories\n\n```\nBusiness Requirements → Security Requirements → Technical Controls\n         ↓                       ↓                      ↓\n  \"Protect customer    \"Encrypt PII at rest\"   \"AES-256 encryption\n   data\"                                        with KMS key rotation\"\n```\n\n### 2. Security Requirement Types\n\n| Type | Focus | Example |\n|------|-------|---------|\n| **Functional** | What system must do | \"System must authenticate users\" |\n| **Non-functional** | How system must perform | \"Authentication must complete in \u003C2s\" |\n| **Constraint** | Limitations imposed | \"Must use approved crypto libraries\" |\n\n### 3. Requirement Attributes\n\n| Attribute | Description |\n|-----------|-------------|\n| **Traceability** | Links to threats\u002Fcompliance |\n| **Testability** | Can be verified |\n| **Priority** | Business importance |\n| **Risk Level** | Impact if not met |\n\n## Templates\n\n### Template 1: Security Requirement Model\n\n```python\nfrom dataclasses import dataclass, field\nfrom enum import Enum\nfrom typing import List, Dict, Optional, Set\nfrom datetime import datetime\n\nclass RequirementType(Enum):\n    FUNCTIONAL = \"functional\"\n    NON_FUNCTIONAL = \"non_functional\"\n    CONSTRAINT = \"constraint\"\n\n\nclass Priority(Enum):\n    CRITICAL = 1\n    HIGH = 2\n    MEDIUM = 3\n    LOW = 4\n\n\nclass SecurityDomain(Enum):\n    AUTHENTICATION = \"authentication\"\n    AUTHORIZATION = \"authorization\"\n    DATA_PROTECTION = \"data_protection\"\n    AUDIT_LOGGING = \"audit_logging\"\n    INPUT_VALIDATION = \"input_validation\"\n    ERROR_HANDLING = \"error_handling\"\n    SESSION_MANAGEMENT = \"session_management\"\n    CRYPTOGRAPHY = \"cryptography\"\n    NETWORK_SECURITY = \"network_security\"\n    AVAILABILITY = \"availability\"\n\n\nclass ComplianceFramework(Enum):\n    PCI_DSS = \"pci_dss\"\n    HIPAA = \"hipaa\"\n    GDPR = \"gdpr\"\n    SOC2 = \"soc2\"\n    NIST_CSF = \"nist_csf\"\n    ISO_27001 = \"iso_27001\"\n    OWASP = \"owasp\"\n\n\n@dataclass\nclass SecurityRequirement:\n    id: str\n    title: str\n    description: str\n    req_type: RequirementType\n    domain: SecurityDomain\n    priority: Priority\n    rationale: str = \"\"\n    acceptance_criteria: List[str] = field(default_factory=list)\n    test_cases: List[str] = field(default_factory=list)\n    threat_refs: List[str] = field(default_factory=list)\n    compliance_refs: List[str] = field(default_factory=list)\n    dependencies: List[str] = field(default_factory=list)\n    status: str = \"draft\"\n    owner: str = \"\"\n    created_date: datetime = field(default_factory=datetime.now)\n\n    def to_user_story(self) -> str:\n        \"\"\"Convert to user story format.\"\"\"\n        return f\"\"\"\n**{self.id}: {self.title}**\n\nAs a security-conscious system,\nI need to {self.description.lower()},\nSo that {self.rationale.lower()}.\n\n**Acceptance Criteria:**\n{chr(10).join(f'- [ ] {ac}' for ac in self.acceptance_criteria)}\n\n**Priority:** {self.priority.name}\n**Domain:** {self.domain.value}\n**Threat References:** {', '.join(self.threat_refs)}\n\"\"\"\n\n    def to_test_spec(self) -> str:\n        \"\"\"Convert to test specification.\"\"\"\n        return f\"\"\"\n## Test Specification: {self.id}\n\n### Requirement\n{self.description}\n\n### Test Cases\n{chr(10).join(f'{i+1}. {tc}' for i, tc in enumerate(self.test_cases))}\n\n### Acceptance Criteria Verification\n{chr(10).join(f'- {ac}' for ac in self.acceptance_criteria)}\n\"\"\"\n\n\n@dataclass\nclass RequirementSet:\n    name: str\n    version: str\n    requirements: List[SecurityRequirement] = field(default_factory=list)\n\n    def add(self, req: SecurityRequirement) -> None:\n        self.requirements.append(req)\n\n    def get_by_domain(self, domain: SecurityDomain) -> List[SecurityRequirement]:\n        return [r for r in self.requirements if r.domain == domain]\n\n    def get_by_priority(self, priority: Priority) -> List[SecurityRequirement]:\n        return [r for r in self.requirements if r.priority == priority]\n\n    def get_by_threat(self, threat_id: str) -> List[SecurityRequirement]:\n        return [r for r in self.requirements if threat_id in r.threat_refs]\n\n    def get_critical_requirements(self) -> List[SecurityRequirement]:\n        return [r for r in self.requirements if r.priority == Priority.CRITICAL]\n\n    def export_markdown(self) -> str:\n        \"\"\"Export all requirements as markdown.\"\"\"\n        lines = [f\"# Security Requirements: {self.name}\\n\"]\n        lines.append(f\"Version: {self.version}\\n\")\n\n        for domain in SecurityDomain:\n            domain_reqs = self.get_by_domain(domain)\n            if domain_reqs:\n                lines.append(f\"\\n## {domain.value.replace('_', ' ').title()}\\n\")\n                for req in domain_reqs:\n                    lines.append(req.to_user_story())\n\n        return \"\\n\".join(lines)\n\n    def traceability_matrix(self) -> Dict[str, List[str]]:\n        \"\"\"Generate threat-to-requirement traceability.\"\"\"\n        matrix = {}\n        for req in self.requirements:\n            for threat_id in req.threat_refs:\n                if threat_id not in matrix:\n                    matrix[threat_id] = []\n                matrix[threat_id].append(req.id)\n        return matrix\n```\n\n### Template 2: Threat-to-Requirement Extractor\n\n```python\nfrom dataclasses import dataclass\nfrom typing import List, Dict, Tuple\n\n@dataclass\nclass ThreatInput:\n    id: str\n    category: str  # STRIDE category\n    title: str\n    description: str\n    target: str\n    impact: str\n    likelihood: str\n\n\nclass RequirementExtractor:\n    \"\"\"Extract security requirements from threats.\"\"\"\n\n    # Mapping of STRIDE categories to security domains and requirement patterns\n    STRIDE_MAPPINGS = {\n        \"SPOOFING\": {\n            \"domains\": [SecurityDomain.AUTHENTICATION, SecurityDomain.SESSION_MANAGEMENT],\n            \"patterns\": [\n                (\"Implement strong authentication for {target}\",\n                 \"Ensure {target} authenticates all users before granting access\"),\n                (\"Validate identity tokens for {target}\",\n                 \"All authentication tokens must be cryptographically verified\"),\n                (\"Implement session management for {target}\",\n                 \"Sessions must be securely managed with proper expiration\"),\n            ]\n        },\n        \"TAMPERING\": {\n            \"domains\": [SecurityDomain.INPUT_VALIDATION, SecurityDomain.DATA_PROTECTION],\n            \"patterns\": [\n                (\"Validate all input to {target}\",\n                 \"All input must be validated against expected formats\"),\n                (\"Implement integrity checks for {target}\",\n                 \"Data integrity must be verified using cryptographic signatures\"),\n                (\"Protect {target} from modification\",\n                 \"Implement controls to prevent unauthorized data modification\"),\n            ]\n        },\n        \"REPUDIATION\": {\n            \"domains\": [SecurityDomain.AUDIT_LOGGING],\n            \"patterns\": [\n                (\"Log all security events for {target}\",\n                 \"Security-relevant events must be logged for audit purposes\"),\n                (\"Implement non-repudiation for {target}\",\n                 \"Critical actions must have cryptographic proof of origin\"),\n                (\"Protect audit logs for {target}\",\n                 \"Audit logs must be tamper-evident and protected\"),\n            ]\n        },\n        \"INFORMATION_DISCLOSURE\": {\n            \"domains\": [SecurityDomain.DATA_PROTECTION, SecurityDomain.CRYPTOGRAPHY],\n            \"patterns\": [\n                (\"Encrypt sensitive data in {target}\",\n                 \"Sensitive data must be encrypted at rest and in transit\"),\n                (\"Implement access controls for {target}\",\n                 \"Data access must be restricted based on need-to-know\"),\n                (\"Prevent information leakage from {target}\",\n                 \"Error messages and logs must not expose sensitive information\"),\n            ]\n        },\n        \"DENIAL_OF_SERVICE\": {\n            \"domains\": [SecurityDomain.AVAILABILITY, SecurityDomain.INPUT_VALIDATION],\n            \"patterns\": [\n                (\"Implement rate limiting for {target}\",\n                 \"Requests must be rate-limited to prevent resource exhaustion\"),\n                (\"Ensure availability of {target}\",\n                 \"System must remain available under high load conditions\"),\n                (\"Implement resource quotas for {target}\",\n                 \"Resource consumption must be bounded and monitored\"),\n            ]\n        },\n        \"ELEVATION_OF_PRIVILEGE\": {\n            \"domains\": [SecurityDomain.AUTHORIZATION],\n            \"patterns\": [\n                (\"Enforce authorization for {target}\",\n                 \"All actions must be authorized based on user permissions\"),\n                (\"Implement least privilege for {target}\",\n                 \"Users must only have minimum necessary permissions\"),\n                (\"Validate permissions for {target}\",\n                 \"Permission checks must be performed server-side\"),\n            ]\n        },\n    }\n\n    def extract_requirements(\n        self,\n        threats: List[ThreatInput],\n        project_name: str\n    ) -> RequirementSet:\n        \"\"\"Extract security requirements from threats.\"\"\"\n        req_set = RequirementSet(\n            name=f\"{project_name} Security Requirements\",\n            version=\"1.0\"\n        )\n\n        req_counter = 1\n        for threat in threats:\n            reqs = self._threat_to_requirements(threat, req_counter)\n            for req in reqs:\n                req_set.add(req)\n            req_counter += len(reqs)\n\n        return req_set\n\n    def _threat_to_requirements(\n        self,\n        threat: ThreatInput,\n        start_id: int\n    ) -> List[SecurityRequirement]:\n        \"\"\"Convert a single threat to requirements.\"\"\"\n        requirements = []\n        mapping = self.STRIDE_MAPPINGS.get(threat.category, {})\n        domains = mapping.get(\"domains\", [])\n        patterns = mapping.get(\"patterns\", [])\n\n        priority = self._calculate_priority(threat.impact, threat.likelihood)\n\n        for i, (title_pattern, desc_pattern) in enumerate(patterns):\n            req = SecurityRequirement(\n                id=f\"SR-{start_id + i:03d}\",\n                title=title_pattern.format(target=threat.target),\n                description=desc_pattern.format(target=threat.target),\n                req_type=RequirementType.FUNCTIONAL,\n                domain=domains[i % len(domains)] if domains else SecurityDomain.DATA_PROTECTION,\n                priority=priority,\n                rationale=f\"Mitigates threat: {threat.title}\",\n                threat_refs=[threat.id],\n                acceptance_criteria=self._generate_acceptance_criteria(\n                    threat.category, threat.target\n                ),\n                test_cases=self._generate_test_cases(\n                    threat.category, threat.target\n                )\n            )\n            requirements.append(req)\n\n        return requirements\n\n    def _calculate_priority(self, impact: str, likelihood: str) -> Priority:\n        \"\"\"Calculate requirement priority from threat attributes.\"\"\"\n        score_map = {\"LOW\": 1, \"MEDIUM\": 2, \"HIGH\": 3, \"CRITICAL\": 4}\n        impact_score = score_map.get(impact.upper(), 2)\n        likelihood_score = score_map.get(likelihood.upper(), 2)\n\n        combined = impact_score * likelihood_score\n\n        if combined >= 12:\n            return Priority.CRITICAL\n        elif combined >= 6:\n            return Priority.HIGH\n        elif combined >= 3:\n            return Priority.MEDIUM\n        return Priority.LOW\n\n    def _generate_acceptance_criteria(\n        self,\n        category: str,\n        target: str\n    ) -> List[str]:\n        \"\"\"Generate acceptance criteria for requirement.\"\"\"\n        criteria_templates = {\n            \"SPOOFING\": [\n                f\"Users must authenticate before accessing {target}\",\n                \"Authentication failures are logged and monitored\",\n                \"Multi-factor authentication is available for sensitive operations\",\n            ],\n            \"TAMPERING\": [\n                f\"All input to {target} is validated\",\n                \"Data integrity is verified before processing\",\n                \"Modification attempts trigger alerts\",\n            ],\n            \"REPUDIATION\": [\n                f\"All actions on {target} are logged with user identity\",\n                \"Logs cannot be modified by regular users\",\n                \"Log retention meets compliance requirements\",\n            ],\n            \"INFORMATION_DISCLOSURE\": [\n                f\"Sensitive data in {target} is encrypted\",\n                \"Access to sensitive data is logged\",\n                \"Error messages do not reveal sensitive information\",\n            ],\n            \"DENIAL_OF_SERVICE\": [\n                f\"Rate limiting is enforced on {target}\",\n                \"System degrades gracefully under load\",\n                \"Resource exhaustion triggers alerts\",\n            ],\n            \"ELEVATION_OF_PRIVILEGE\": [\n                f\"Authorization is checked for all {target} operations\",\n                \"Users cannot access resources beyond their permissions\",\n                \"Privilege changes are logged and monitored\",\n            ],\n        }\n        return criteria_templates.get(category, [])\n\n    def _generate_test_cases(\n        self,\n        category: str,\n        target: str\n    ) -> List[str]:\n        \"\"\"Generate test cases for requirement.\"\"\"\n        test_templates = {\n            \"SPOOFING\": [\n                f\"Test: Unauthenticated access to {target} is denied\",\n                \"Test: Invalid credentials are rejected\",\n                \"Test: Session tokens cannot be forged\",\n            ],\n            \"TAMPERING\": [\n                f\"Test: Invalid input to {target} is rejected\",\n                \"Test: Tampered data is detected and rejected\",\n                \"Test: SQL injection attempts are blocked\",\n            ],\n            \"REPUDIATION\": [\n                \"Test: Security events are logged\",\n                \"Test: Logs include sufficient detail for forensics\",\n                \"Test: Log integrity is protected\",\n            ],\n            \"INFORMATION_DISCLOSURE\": [\n                f\"Test: {target} data is encrypted in transit\",\n                f\"Test: {target} data is encrypted at rest\",\n                \"Test: Error messages are sanitized\",\n            ],\n            \"DENIAL_OF_SERVICE\": [\n                f\"Test: Rate limiting on {target} works correctly\",\n                \"Test: System handles burst traffic gracefully\",\n                \"Test: Resource limits are enforced\",\n            ],\n            \"ELEVATION_OF_PRIVILEGE\": [\n                f\"Test: Unauthorized access to {target} is denied\",\n                \"Test: Privilege escalation attempts are blocked\",\n                \"Test: IDOR vulnerabilities are not present\",\n            ],\n        }\n        return test_templates.get(category, [])\n```\n\n### Template 3: Compliance Mapping\n\n```python\nfrom typing import Dict, List, Set\n\nclass ComplianceMapper:\n    \"\"\"Map security requirements to compliance frameworks.\"\"\"\n\n    FRAMEWORK_CONTROLS = {\n        ComplianceFramework.PCI_DSS: {\n            SecurityDomain.AUTHENTICATION: [\"8.1\", \"8.2\", \"8.3\"],\n            SecurityDomain.AUTHORIZATION: [\"7.1\", \"7.2\"],\n            SecurityDomain.DATA_PROTECTION: [\"3.4\", \"3.5\", \"4.1\"],\n            SecurityDomain.AUDIT_LOGGING: [\"10.1\", \"10.2\", \"10.3\"],\n            SecurityDomain.NETWORK_SECURITY: [\"1.1\", \"1.2\", \"1.3\"],\n            SecurityDomain.CRYPTOGRAPHY: [\"3.5\", \"3.6\", \"4.1\"],\n        },\n        ComplianceFramework.HIPAA: {\n            SecurityDomain.AUTHENTICATION: [\"164.312(d)\"],\n            SecurityDomain.AUTHORIZATION: [\"164.312(a)(1)\"],\n            SecurityDomain.DATA_PROTECTION: [\"164.312(a)(2)(iv)\", \"164.312(e)(2)(ii)\"],\n            SecurityDomain.AUDIT_LOGGING: [\"164.312(b)\"],\n        },\n        ComplianceFramework.GDPR: {\n            SecurityDomain.DATA_PROTECTION: [\"Art. 32\", \"Art. 25\"],\n            SecurityDomain.AUDIT_LOGGING: [\"Art. 30\"],\n            SecurityDomain.AUTHORIZATION: [\"Art. 25\"],\n        },\n        ComplianceFramework.OWASP: {\n            SecurityDomain.AUTHENTICATION: [\"V2.1\", \"V2.2\", \"V2.3\"],\n            SecurityDomain.SESSION_MANAGEMENT: [\"V3.1\", \"V3.2\", \"V3.3\"],\n            SecurityDomain.INPUT_VALIDATION: [\"V5.1\", \"V5.2\", \"V5.3\"],\n            SecurityDomain.CRYPTOGRAPHY: [\"V6.1\", \"V6.2\"],\n            SecurityDomain.ERROR_HANDLING: [\"V7.1\", \"V7.2\"],\n            SecurityDomain.DATA_PROTECTION: [\"V8.1\", \"V8.2\", \"V8.3\"],\n            SecurityDomain.AUDIT_LOGGING: [\"V7.1\", \"V7.2\"],\n        },\n    }\n\n    def map_requirement_to_compliance(\n        self,\n        requirement: SecurityRequirement,\n        frameworks: List[ComplianceFramework]\n    ) -> Dict[str, List[str]]:\n        \"\"\"Map a requirement to compliance controls.\"\"\"\n        mapping = {}\n        for framework in frameworks:\n            controls = self.FRAMEWORK_CONTROLS.get(framework, {})\n            domain_controls = controls.get(requirement.domain, [])\n            if domain_controls:\n                mapping[framework.value] = domain_controls\n        return mapping\n\n    def get_requirements_for_control(\n        self,\n        requirement_set: RequirementSet,\n        framework: ComplianceFramework,\n        control_id: str\n    ) -> List[SecurityRequirement]:\n        \"\"\"Find requirements that satisfy a compliance control.\"\"\"\n        matching = []\n        framework_controls = self.FRAMEWORK_CONTROLS.get(framework, {})\n\n        for domain, controls in framework_controls.items():\n            if control_id in controls:\n                matching.extend(requirement_set.get_by_domain(domain))\n\n        return matching\n\n    def generate_compliance_matrix(\n        self,\n        requirement_set: RequirementSet,\n        frameworks: List[ComplianceFramework]\n    ) -> Dict[str, Dict[str, List[str]]]:\n        \"\"\"Generate compliance traceability matrix.\"\"\"\n        matrix = {}\n\n        for framework in frameworks:\n            matrix[framework.value] = {}\n            framework_controls = self.FRAMEWORK_CONTROLS.get(framework, {})\n\n            for domain, controls in framework_controls.items():\n                for control in controls:\n                    reqs = self.get_requirements_for_control(\n                        requirement_set, framework, control\n                    )\n                    if reqs:\n                        matrix[framework.value][control] = [r.id for r in reqs]\n\n        return matrix\n\n    def gap_analysis(\n        self,\n        requirement_set: RequirementSet,\n        framework: ComplianceFramework\n    ) -> Dict[str, List[str]]:\n        \"\"\"Identify compliance gaps.\"\"\"\n        gaps = {\"missing_controls\": [], \"weak_coverage\": []}\n        framework_controls = self.FRAMEWORK_CONTROLS.get(framework, {})\n\n        for domain, controls in framework_controls.items():\n            domain_reqs = requirement_set.get_by_domain(domain)\n            for control in controls:\n                matching = self.get_requirements_for_control(\n                    requirement_set, framework, control\n                )\n                if not matching:\n                    gaps[\"missing_controls\"].append(f\"{framework.value}:{control}\")\n                elif len(matching) \u003C 2:\n                    gaps[\"weak_coverage\"].append(f\"{framework.value}:{control}\")\n\n        return gaps\n```\n\n### Template 4: Security User Story Generator\n\n```python\nclass SecurityUserStoryGenerator:\n    \"\"\"Generate security-focused user stories.\"\"\"\n\n    STORY_TEMPLATES = {\n        SecurityDomain.AUTHENTICATION: {\n            \"as_a\": \"security-conscious user\",\n            \"so_that\": \"my identity is protected from impersonation\",\n        },\n        SecurityDomain.AUTHORIZATION: {\n            \"as_a\": \"system administrator\",\n            \"so_that\": \"users can only access resources appropriate to their role\",\n        },\n        SecurityDomain.DATA_PROTECTION: {\n            \"as_a\": \"data owner\",\n            \"so_that\": \"my sensitive information remains confidential\",\n        },\n        SecurityDomain.AUDIT_LOGGING: {\n            \"as_a\": \"security analyst\",\n            \"so_that\": \"I can investigate security incidents\",\n        },\n        SecurityDomain.INPUT_VALIDATION: {\n            \"as_a\": \"application developer\",\n            \"so_that\": \"the system is protected from malicious input\",\n        },\n    }\n\n    def generate_story(self, requirement: SecurityRequirement) -> str:\n        \"\"\"Generate a user story from requirement.\"\"\"\n        template = self.STORY_TEMPLATES.get(\n            requirement.domain,\n            {\"as_a\": \"user\", \"so_that\": \"the system is secure\"}\n        )\n\n        story = f\"\"\"\n## {requirement.id}: {requirement.title}\n\n**User Story:**\nAs a {template['as_a']},\nI want the system to {requirement.description.lower()},\nSo that {template['so_that']}.\n\n**Priority:** {requirement.priority.name}\n**Type:** {requirement.req_type.value}\n**Domain:** {requirement.domain.value}\n\n**Acceptance Criteria:**\n{self._format_acceptance_criteria(requirement.acceptance_criteria)}\n\n**Definition of Done:**\n- [ ] Implementation complete\n- [ ] Security tests pass\n- [ ] Code review complete\n- [ ] Security review approved\n- [ ] Documentation updated\n\n**Security Test Cases:**\n{self._format_test_cases(requirement.test_cases)}\n\n**Traceability:**\n- Threats: {', '.join(requirement.threat_refs) or 'N\u002FA'}\n- Compliance: {', '.join(requirement.compliance_refs) or 'N\u002FA'}\n\"\"\"\n        return story\n\n    def _format_acceptance_criteria(self, criteria: List[str]) -> str:\n        return \"\\n\".join(f\"- [ ] {c}\" for c in criteria) if criteria else \"- [ ] TBD\"\n\n    def _format_test_cases(self, tests: List[str]) -> str:\n        return \"\\n\".join(f\"- {t}\" for t in tests) if tests else \"- TBD\"\n\n    def generate_epic(\n        self,\n        requirement_set: RequirementSet,\n        domain: SecurityDomain\n    ) -> str:\n        \"\"\"Generate an epic for a security domain.\"\"\"\n        reqs = requirement_set.get_by_domain(domain)\n\n        epic = f\"\"\"\n# Security Epic: {domain.value.replace('_', ' ').title()}\n\n## Overview\nThis epic covers all security requirements related to {domain.value.replace('_', ' ')}.\n\n## Business Value\n- Protect against {domain.value.replace('_', ' ')} related threats\n- Meet compliance requirements\n- Reduce security risk\n\n## Stories in this Epic\n{chr(10).join(f'- [{r.id}] {r.title}' for r in reqs)}\n\n## Acceptance Criteria\n- All stories complete\n- Security tests passing\n- Security review approved\n- Compliance requirements met\n\n## Risk if Not Implemented\n- Vulnerability to {domain.value.replace('_', ' ')} attacks\n- Compliance violations\n- Potential data breach\n\n## Dependencies\n{chr(10).join(f'- {d}' for r in reqs for d in r.dependencies) or '- None identified'}\n\"\"\"\n        return epic\n```\n\n## Best Practices\n\n### Do's\n- **Trace to threats** - Every requirement should map to threats\n- **Be specific** - Vague requirements can't be tested\n- **Include acceptance criteria** - Define \"done\"\n- **Consider compliance** - Map to frameworks early\n- **Review regularly** - Requirements evolve with threats\n\n### Don'ts\n- **Don't be generic** - \"Be secure\" is not a requirement\n- **Don't skip rationale** - Explain why it matters\n- **Don't ignore priorities** - Not all requirements are equal\n- **Don't forget testability** - If you can't test it, you can't verify it\n- **Don't work in isolation** - Involve stakeholders\n\n## Resources\n\n- [OWASP ASVS](https:\u002F\u002Fowasp.org\u002Fwww-project-application-security-verification-standard\u002F)\n- [NIST SP 800-53](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-53\u002Frev-5\u002Ffinal)\n- [Security User Stories](https:\u002F\u002Fwww.oreilly.com\u002Flibrary\u002Fview\u002Fagile-application-security\u002F9781491938836\u002F)\n",{"name":5,"description":7},"main","7850740bd837adb32f0a109ab2af82482196c6f2","skills\u002F_collections\u002Fwshobson-agents\u002Fplugins\u002Fsecurity-scanning\u002Fskills\u002Fsecurity-requirement-extraction",1,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills","https:\u002F\u002Fzturnsgo.com","https:\u002F\u002Fgithub.com\u002Fshengdabai","https:\u002F\u002Fzturnsgo.com\u002F","AI × education creator — producer, not consumer. Taught 6,000+ learners; shipping learning tools & daily essays with Claude Code, practicing @xiaolai's way 🥋","2026-11-01 21:28:23",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add shengdabai\u002FTony-Claude-Code-Skills --skill security-requirement-extraction",{"tool":62,"command":63},"bunx","bunx skills add shengdabai\u002FTony-Claude-Code-Skills --skill security-requirement-extraction",{"tool":65,"command":66},"pnpm","pnpm dlx skills add shengdabai\u002FTony-Claude-Code-Skills --skill security-requirement-extraction","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fwshobson-agents\u002Fplugins\u002Fsecurity-scanning\u002Fskills\u002Fsecurity-requirement-extraction\u002FSKILL.md",true,[],[71,90,122,146,168,188],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":82,"publishedAt":41},"01M70P17DAD4C1C47NPH6A96EM","xiaolai-methodology","以李笑来(Li Xiaolai)的思考方式、方法论与表达风格,为用户做全方位 1-on-1 教练指导,覆盖创业、赚钱、投资、学习、自学、读书写作、用 AI、以及人生心态与自我管理。当用户提到 \"李笑来\"、\"笑来\"、\"笑来老师\"、\"扮演李笑来\"、\"找笑来聊聊\"、\"笑来怎么看\"、\"xiaolai\"、\"把时间当作朋友\"、\"通往财富自由之路\"、\"定投改变命运\"、\"韭菜的自我修养\"、\"自学是门手艺\"、\"让时间陪你慢慢变富\"、\"七年就是一辈子\"、\"元认知\"、\"活在未来\"、\"复利\u002F长期主义\"、\"践行\"、\"痴迷改进\"、\"个人商业模式\u002F出售时间\"、\"睡后收入\"、\"定投\"、\"财富自由\"、\"操作系统升级\"、\"最少必要知识\"、\"北极星提示词\"、\"用 AI 该怎么学\u002F思考\" 等任一触发词,或当用户带着关于创业\u002F赚钱\u002F投资\u002F学习\u002F职业\u002F重大人生决策的困惑、希望被人用笑来式的「逻辑 + 大白话 + 类比 + 重新定义 + 践行导向」来点醒和指导时,自动进入李笑来教练模式。","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fxiaolai-methodology\u002FSKILL.md",[77],{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",[83,84,85,86,87,88,89],"methodology","xiaolai","xiaolai methodology","朋友","投资","writing","收入",{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":102,"publishedAt":41},"01M70P13NB9YP7ACJR1S861CDS","zread","Produce and consume a wiki-style knowledge base for a code repository via the `zread` CLI and its on-disk output under `.\u002F.zread\u002Fwiki\u002F`. Use this skill whenever the user wants to understand, onboard onto, explore, summarize, map, or get an overview of an unfamiliar codebase; asks for architecture docs, a project wiki, a repo walkthrough, module\u002Fpackage explanations, or \"what does this repo do\"; wants to generate, regenerate, resume, browse, or serve code documentation locally; or mentions zread \u002F zread.ai directly. Also use it proactively before diving into a large unknown repo — if `.\u002F.zread\u002Fwiki\u002Fcurrent` exists, read the generated pages instead of crawling source file-by-file; if it doesn't, consider offering to run `zread generate`. The trigger is the intent (understand a codebase through generated docs), not the literal word \"zread\".","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fzread\u002FSKILL.md",[96,99],{"categoryNo":97,"categoryName":98,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":100,"categoryName":101,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000030","开发工程师",[92,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121],"knowledge","wiki","explore","walkthrough","project","get","knowledge base","run","generate","intent","cli","map","documentation","project wiki","disk","architecture","code","unknown","generated",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":132,"publishedAt":41},"01M70P10S4SWMZQ8BJAFBFDRW3","youtube","Launch the YouTube Creator Agent to auto-generate videos.\nUse when: user types \u002Fyoutube, wants to create YouTube videos,\ngenerate video content, or upload to YouTube.\nKeywords: youtube, video, 视频, 创作视频, 发布视频","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fyoutube\u002FSKILL.md",[128,129],{"categoryNo":97,"categoryName":98,"taxonomyType":80,"taxonomyTypeDesc":81},{"categoryNo":130,"categoryName":131,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",[124,28,133,134,135,136,137,138,111,139,140,141,37,39,142,143,144,145],"content","视频","creator","generate video","videos","launch","video content","create","upload","auto","types","Video","创作",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":153,"publishedAt":41},"01M70P0YE95D8BACZCGV8BK90K","youtube-script-sync","Sync, update, or optimize Tony's GetNote knowledge base `Youtube视频逐字稿` by turning each parent recording or first-person idea note into an idempotent child note containing a directly recordable YouTube long-video or Shorts script. Use when the user says “更新\u002F同步\u002F优化 Youtube视频逐字稿知识库”, or says “更新\u002F同步\u002F优化该知识库” while this knowledge base is the active context.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fyoutube-script-sync\u002FSKILL.md",[152],{"categoryNo":97,"categoryName":98,"taxonomyType":80,"taxonomyTypeDesc":81},[154,155,124,156,157,144,158,159,160,161,162,163,164,165,109,166,37,39,103,167],"sync","script","youtube script sync","recording","shorts","first","base","person","update","active","child","optimize","idempotent","long",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":178,"publishedAt":41},"01M70P0WMV5XT0EEC0N445PW07","writing-skills","How to write SKILL.md files that trigger reliably and teach effectively. Use when creating, improving, or reviewing Claude Code skills.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fxiaolai\u002Fnlpm\u002Fskills\u002Fnlpm\u002Fwriting-skills\u002FSKILL.md",[174,175,176,177],{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},{"categoryNo":97,"categoryName":98,"taxonomyType":80,"taxonomyTypeDesc":81},{"categoryNo":100,"categoryName":101,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":130,"categoryName":131,"taxonomyType":21,"taxonomyTypeDesc":22},[179,88,180,181,182,183,119,37,39,184,185,186,187],"writing skills","how","teach","write skill","write","claude code skills","files","how to","trigger",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":196,"publishedAt":41},"01M70P0SJFR4YVJQBGMHKGSKXT","writing-rules","How to write .claude\u002Frules\u002F files that Claude actually follows. Use when creating, improving, or reviewing project rules.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fxiaolai\u002Fnlpm\u002Fskills\u002Fnlpm\u002Fwriting-rules\u002FSKILL.md",[194,195],{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},{"categoryNo":130,"categoryName":131,"taxonomyType":21,"taxonomyTypeDesc":22},[197,88,198,107,199,185,37,180,183,39,186],"Rules","writing rules","project rules"]