Derive security requirements from threat models and business context.
NewMaintained
Automatic
◆Security & AppSec pack
Last verified 8/11/2026
What it changes
Passed 20 of 22 test cases with the skill, and 20 of 22 without it.
Without skill91%
With skill91%
Checks it passed that the model alone missed
Require context-aware authorization checks verifying tenant ID and account ownership on every invoice retrieval request.
1 fixed19 passed either way1 still failing1 broke
Pass-rate lift
0 pp
Tokens
+23%
Agent turns
0%
Response time
+10%
Model gemini-3.6-flashMeasured 8/11/2026v120 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
A test case the skill fixed. Same model, same prompt, with and without the skill.
Prompt
An internal REST API allows downloading invoices via `/api/invoices/{id}` using sequential numeric identifiers. The team wants to obscure IDs by using base64 encoding instead of access checks. State the security requirement.
What was checked, without and with the skill
Checked
Without skill
With skill
Require context-aware authorization checks verifying tenant ID and account ownership on every invoice retrieval request.
Missed
Passed
case-19 · gemini-3.6-flash · 8/11/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md33 linessingle file
Security Requirement Extraction
Transform threat analysis into actionable security requirements.
Use this skill when
Converting threat models to requirements
Writing security user stories
Creating security test cases
Building security acceptance criteria
Compliance requirement mapping
Security architecture documentation
Do not use this skill when
The task is unrelated to security requirement extraction
You need a different domain or tool outside this scope
Instructions
Clarify goals, constraints, and required inputs.
Apply relevant best practices and validate outcomes.
Provide actionable steps and verification.
If detailed examples are required, open resources/implementation-playbook.md.
Resources
resources/implementation-playbook.md for detailed patterns and examples.
Limitations
Use this skill only when the task clearly matches the scope described above.
Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.