Generate Security Requirements from Threat Models

This skill transforms threat analysis into actionable security requirements, deriving them from threat models and business context. Its instructions are to clarify goals, constraints, and required inputs, apply relevant best practices and validate outcomes, and provide actionable steps and verification, with a resources/implementation-playbook.md pointer for detailed patterns and examples beyond what the skill card itself carries.

Use it when converting threat models to requirements, writing security user stories, creating security test cases, building security acceptance criteria, mapping compliance requirements, or producing security architecture documentation.

Do not use it when the task is unrelated to security requirement extraction, or when you need a different domain or tool outside this scope.

Inputs are a threat model and the business context around it. Outputs are actionable security requirements, security user stories, security test cases, security acceptance criteria, and compliance requirement mappings derived from that threat analysis.

It is for security engineers, architects, and product teams who need to turn a threat model into requirements, stories, and test cases that development teams can act on directly.