---
name: extraccion-requisitos-seguridad
description: Transforma modelos de amenazas y contexto de negocio en requisitos de seguridad accionables, historias de usuario y casos de prueba trazables a riesgos reales.
license: MIT
metadata:
  id: 65648eae
  slug: extraccion-requisitos-seguridad
  titulo: "Extracción de Requisitos de Seguridad"
  servicio: Seguridad
  categoria_recurso: Plantillas-Documentos
  tipo: analisis
  nivel: avanzado
  idioma: es
  idioma_original: en
  acceso: gratis
  precio_eur: 0
  plataformas: [Claude Code, Codex CLI, Cursor, OpenCode, Gemini CLI]
  dependencias: []
  licencia: { spdx: MIT, redistribuible: true, uso_comercial: true }
  fuente:
    repo: wshobson/agents
    url: https://github.com/wshobson/agents/tree/main/plugins/security-scanning/skills/security-requirement-extraction
    commit: cc37bfd
    autor: wshobson
    nombre_original: security-requirement-extraction
    duplicados_en: []
  seguridad: { veredicto: seguro, riesgo: bajo, escaneado: "2026-06-14", motor: "grep-estatico+auditor-llm" }
  ficha:
    que_hace: "Convierte amenazas identificadas en requisitos de seguridad funcionales, no funcionales y de restricción con criterios de aceptación verificables."
    como_lo_hace: "Aplica un marco estructurado de trazabilidad amenaza-requisito-control técnico, categorizando por tipo, prioridad y nivel de riesgo, con mapeo a marcos de cumplimiento."
  content_hash: "65648eaee95f8d4b7a4a186935b14949ae821a6ae6d07256175c4e4a005d1096"
  version: 1.0.0
---

# Security Requirement Extraction

Transform threat analysis into actionable security requirements.

## When to Use This Skill

- Converting threat models to requirements
- Writing security user stories
- Creating security test cases
- Building security acceptance criteria
- Compliance requirement mapping
- Security architecture documentation

## Core Concepts

### 1. Requirement Categories

```
Business Requirements → Security Requirements → Technical Controls
         ↓                       ↓                      ↓
  "Protect customer    "Encrypt PII at rest"   "AES-256 encryption
   data"                                        with KMS key rotation"
```

### 2. Security Requirement Types

| Type               | Focus                   | Example                               |
| ------------------ | ----------------------- | ------------------------------------- |
| **Functional**     | What system must do     | "System must authenticate users"      |
| **Non-functional** | How system must perform | "Authentication must complete in <2s" |
| **Constraint**     | Limitations imposed     | "Must use approved crypto libraries"  |

### 3. Requirement Attributes

| Attribute        | Description                 |
| ---------------- | --------------------------- |
| **Traceability** | Links to threats/compliance |
| **Testability**  | Can be verified             |
| **Priority**     | Business importance         |
| **Risk Level**   | Impact if not met           |

## Templates and detailed worked examples

Full template library lives in `references/details.md`. Read that file when you need concrete templates for this skill.

## Best Practices

### Do's

- **Trace to threats** - Every requirement should map to threats
- **Be specific** - Vague requirements can't be tested
- **Include acceptance criteria** - Define "done"
- **Consider compliance** - Map to frameworks early
- **Review regularly** - Requirements evolve with threats

### Don'ts

- **Don't be generic** - "Be secure" is not a requirement
- **Don't skip rationale** - Explain why it matters
- **Don't ignore priorities** - Not all requirements are equal
- **Don't forget testability** - If you can't test it, you can't verify it
- **Don't work in isolation** - Involve stakeholders