Requirement Zero
Challenge whether a requirement deserves to exist before planning or implementing it. Use when a request asks to build, add, or design something and its necessity or scope has not been established — new features, abstractions, plugin systems, dashboards, configurability, migrations, or "we should probably support X". Reaches an explicit verdict: DELETE, REDUCE, DEFER, BUILD, or BUILD HARD. Do not use for already-validated work, bug fixes, or explicit safety, security, legal, or compliance requirements.
Install
npx skills add Chisanan232/requirement-zero --skill requirement-zerogit clone --depth 1 https://github.com/Chisanan232/requirement-zero.git /tmp/requirement-zero
mkdir -p ~/.claude/skills
cp -r /tmp/requirement-zero/. ~/.claude/skills/requirement-zeroPersonal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.
From the SKILL.md
# Requirement Zero
**Every requirement must earn its right to exist.**
Reach a verdict on whether the requirement should exist before designing or writing code. Do
not scaffold files, choose libraries, or write implementation until the verdict is BUILD or
BUILD HARD.
## Ordered discipline
Run these in order. Do not reorder — simplifying unnecessary work is wasted work, and
automating an unproven workflow makes an unnecessary process cheaper to keep. Stop at the first
step that produces a terminal verdict — DELETE, REDUCE, or DEFER. BUILD and BUILD HARD are not
terminal: continue to step 4 to size what gets built.
1. **QUESTION** — What fundamental outcome is required, stated as an observable change for
someone outside the codebase? Who created this requirement — a named person, an incident, a
measurement, a written obligation? If the source is a role, a document, or a norm ("legal
says", "architecture requires", "industry best practice", "the CEO asked for it", "for
compliance"), provenance is unresolved: ask which specific rule, clause, or event it comes
from before accepting any scope from it.
2. **DELETE** — Try to remove the whole thing, then its parts. Ask: if this ships without it,
who notices, and through what signal? Name the observer and name the signal. If neither can
be named, DELETE. If the whole survives, run the same test on each part — fields, states,Details
- Skill name
requirement-zero- Repository
- Chisanan232/requirement-zero
- License
- MIT
- Repo updated
- 9 October 2026
- Listed in
- karanb192/awesome-claude-skills
FAQ
What does the Requirement Zero skill do?
Challenge whether a requirement deserves to exist before planning or implementing it. Use when a request asks to build, add, or design something and its necessity or scope has not been established — new features, abstractions, plugin systems, dashboards, configurability, migrations, or "we should probably support X". Reaches an explicit verdict: DELETE, REDUCE, DEFER, BUILD, or BUILD HARD. Do not use for already-validated work, bug fixes, or explicit safety, security, legal, or compliance requirements.
How do I install the Requirement Zero skill?
skills CLI (Claude Code, Cursor, Codex and more): npx skills add Chisanan232/requirement-zero --skill requirement-zero. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.
Related skills
Analyzing Dependencies
jeremylongshore/claude-code-plugins-plus-skills
This skill analyzes project dependencies for security vulnerabilities, outdated packages, and license compliance issues. It helps identify potential risks in your project's dependencies using the dependency-checker plugin. Use this skill when you need to check dependencies for vulnerabilities, identify outdated packages that need updates, or ensure license compatibility. Trigger phrases include "check dependencies", "dependency check", "find vulnerabilities", "scan for outdated packages", "/depcheck", and "license compliance". This skill supports npm, pip, composer, gem, and go modules project
Cra Vulnerability Obligations
Ansvar-Systems/cra-vulnerability-obligations-skill
Use when a user asks what the EU Cyber Resilience Act (CRA) means for their product, whether and when they must report a vulnerability or incident, or what a specific CVE triggers legally. Maps a product with digital elements to CRA scope, product classification, Annex I vulnerability-handling duties, and Article 14 reporting obligations — every legal claim cited from official regulation text fetched live through the Ansvar Gateway MCP connector, joined with live CVE / CISA-KEV / EPSS vulnerability intelligence from the same connector.
Analyzing Security Headers
jeremylongshore/claude-code-plugins-plus-skills
This skill analyzes HTTP security headers of a given domain to identify potential vulnerabilities and misconfigurations. It provides a detailed report with a grade, score, and recommendations for improvement. Use this skill when the user asks to "analyze security headers", "check HTTP security", "scan for security vulnerabilities", or requests a "security audit" of a website. It will automatically activate when security-related keywords are used in conjunction with domain names or URLs.
Awesome Bug Bounty
YangTech-gh/Awesome-Bug-Bounty
Use when doing bug bounty hunting, vulnerability research, security report writing/analysis, payload or WAF-bypass selection, business logic / IDOR / race / API testing, recon methodology, tool choice (Burp vs Caido vs ZAP, AI pentest agents, MCP security testing, headless browsers), or looking up writeups/programs — e.g. "find XSS payload", "business logic checklist", "SSRF bypass", "HackerOne top reports", "bug bounty methodology", "which tools to install". Merges curated knowledge with source-repo fallbacks; authorized testing only.
Assisting With Soc2 Audit Preparation
jeremylongshore/claude-code-plugins-plus-skills
This skill assists with SOC2 audit preparation by automating tasks related to evidence gathering and documentation. It leverages the soc2-audit-helper plugin to generate reports, identify potential compliance gaps, and suggest remediation steps. Use this skill when the user requests help with "SOC2 audit", "compliance check", "security controls", "audit preparation", or "evidence gathering" related to SOC2. It streamlines the initial stages of SOC2 compliance, focusing on automated data collection and preliminary analysis.
Regulatory Threat Model
1Ansvar-Systems/regulatory-threat-model-skill
Use when an application or system — including one built quickly with AI coding agents — needs a security review with regulatory grounding: a STRIDE threat model, a LINDDUN privacy threat model, a dependency exposure screen against live CVE / CISA-KEV / EPSS data, or a selected, non-exhaustive screen of which EU security obligations (GDPR, NIS2, Cyber Resilience Act, AI Act) may apply and which need determination. Orchestrates the server-enforced threat-modeling workflows of the Ansvar Gateway MCP connector and grounds every regulatory statement in officially published text fetched at answer ti
Browse the most popular Claude skills, all security skills, or write your own with the skills generator.