I Tried Using Security Skills with Claude, and Ended Up Building My Own Skill Too

Hello. I'm Ikeda from the SRE team in the Retail Distribution Solutions Department.

In my previous article and the one before that, I introduced how I built a prototype and ran a PoC of a system for managing access permissions to our company's AWS accounts.
I am now building it using only AWS services, based on the results of the PoC.

Meanwhile, information about vulnerabilities in all kinds of software and services has been coming in every day.
Naturally, it would be a serious problem if the system I'm building had vulnerabilities too, so I was wondering whether I could somehow use Claude Code or tsumiki to run security checks and improve the code. Just then, a member of my department shared with me: "I made a skill that checks against IPA's How to Create Secure Websites."

Findings That Never Go Away

What was shared with me was a Claude Code skill named /ipa-security-check.
I immediately used that skill to check the system I was building, and far more findings came up than I expected. I asked Claude to fix things based on the output report file, and when it reported completion, I ran the check again. I repeated this several times, but the findings never went away.
So I consulted the author of the skill, and they told me, "It's unreasonable to have it consider a fix plan for a bunch of items with different requirements all at once," and I realized, of course.

Another problem I ran into was that the number of findings was large, and it wasn't obvious at a glance "which ones to tackle first." Also, some items were mixed in where I felt "I can't fully grasp what this finding is pointing out from the report alone (I'd have to read the code too to understand it)," and I felt it was a somewhat high hurdle to judge that myself and move forward.

In that case, I decided to create a skill, /ipa-security-guide, that reads the report and converts the remediation work into individual tasks.
Since I routinely use Claude Code's tsumiki plugin for everyday tool development and the like, I aimed to hand the fix tasks one by one to tsumiki:dev-debug and have it handle them.

The /ipa-security-guide I finished at first took quite a while to process, so I had intended to use it as a personal skill. But I thought that making the two skills usable as a set might be at least somewhat useful to tsumiki users, so I improved the processing flow and so on.
As a result, by repeatedly running tests on the same project and streamlining the internal processing, I think it has become much better. Of course, it depends on the size of the target project and the number of findings in the report.

The First Time in My Life My Code Was Merged into OSS

When I showed the improved skill to the author of /ipa-security-check, they asked me to submit a PR to add this skill to tsumiki. It was my first PR to OSS ever, and my code was released as a new feature of tsumiki 1.4.1 on May 19, 2026.

Benefits of Using These Two Skills

• You get well-grounded findings — Detection results come with citations from the original IPA documents (document name, chapter, page), so you can explain "why it's a problem" to project members
• Priorities for remediation are determined — Even when there are many findings, you can start fixing based on a guide narrowed down to "start here first"
• You get material for judging whether action is unnecessary — It proposes, with justification, items for which the risk doesn't hold due to the architecture (the final decision is made by you or the project members)
• Everything through the fix is completed within Claude Code — The flow of report generation → task list generation → fixing with /tsumiki:dev-debug can run without switching tools

I feel that the biggest benefit for system developers is that, as these accumulate, the system being developed reaches a state where security problems can be eliminated in line with IPA standards.

Bonus

From here on, I'll introduce how to use ipa-security-check and ipa-security-guide, and the "security check → fix task generation → fix execution" flow made possible with tsumiki 1.4.1. Some of it repeats what I've already written, but I'd be happy if you read it as a simple manual.

What Is ipa-security-check

This is a skill that statically analyzes local source code based on the following five documents published by IPA (Information-technology Promotion Agency, Japan). It is available from tsumiki 1.4.0.

A distinguishing feature is that every finding comes with "which IPA document and which page it is described on." You can confirm "why this is a problem" in an official document.

How to Use

/ipa-security-check              # カレントディレクトリ全体をスキャン
/ipa-security-check src/         # 特定ディレクトリのみ
/ipa-security-check --diff       # main との差分ファイルのみ

Results are saved to ipa-security-report.md.

What Is ipa-security-guide

This is a skill that reads the report output by ipa-security-check and converts each finding into a prioritized fix task. Because it reads the codebase directly to judge the architecture, it has no dependency on external tools. It is available from tsumiki 1.4.1.

Output Content

1. List of Candidates Not Requiring Action

It lists, along with the reasoning, items that can be judged as "not applicable in this environment" due to architectural or design reasons. The final decision is made by the user, but it puts into words "why this finding doesn't need action."

2. Prioritized Request List

It converts the remaining findings into a format that can be copied and pasted as-is into /tsumiki:dev-debug. It organizes things not just as "what to fix" but down to "how to request that it be fixed."
For example, it outputs in a format like the following.

/tsumiki:dev-debug

shared/types/validation.ts の access_url フィールドが z.string().url() のみで、javascript:/data:/vbscript: スキームを有効な URL として受け入れる。バックエンドで危険スキームを排除できていないため悪意ある URL が DB に保存されるリスクがある。フロントエンドでは /^https?:\/\//i チェックが実施されているが、バックエンドの根本的解決が欠如している。

対象ファイル:
- shared/types/validation.ts:84

access_url の定義に .refine() を追加して http:// または https:// スキームのみ許可するバリデーションを実装する。修正後はテストを実行して既存バリデーション動作が壊れていないことを確認する。

参考: ipa-security-report_20260518.md IPA-SWS-1-XSS-007

3. Summary Table

It organizes all items in a list table. You can see at a glance the sorting into those that need no action and those that do.

How to Use

/ipa-security-guide                          # カレントディレクトリの ipa-security-report.md を読む
/ipa-security-guide <レポートファイルパス>   # レポートファイルを指定
/ipa-security-guide -o guide-result.md       # 結果をファイルに保存

When run without arguments, it reads ipa-security-report.md in the current directory.

Usage and Flow

By combining the two skills, the following flow can be completed with Claude Code + tsumiki.

1. /ipa-security-check
   → ipa-security-report.md を生成

2. /ipa-security-guide
   → 対応不要候補を確認・判断
   → 優先順位付きタスクリストを生成

3. /tsumiki:dev-debug（生成されたタスクリストをコピペ）
   → 修正を実施

4. （必要に応じて）コミットとプッシュ

5. /clear

（他に修正があれば 3. に戻る）

6. （必要に応じて）デプロイ

Impressions After Trying It

The explanations for the judgments on candidates not requiring action were easy to understand, and I was able to make the final decision that almost all of them were indeed items needing no action.
dev-debug quickly checks and fixes various errors without needing plan creation, and I feel that when the fix content and its rationale are clear, it works even more blazingly fast.

Summary

Using ipa-security-check and ipa-security-guide, you can complete everything from static analysis based on IPA documents to fixing code with security risks entirely within Claude Code.
I believe that being able to eliminate the "common security risks" that IPA has identified, even without specialized knowledge, will be useful in system development in the AI era.
I'd be glad if not only engineers who develop systems on a daily basis, but also non-engineers who have started trying to build some kind of tool using Claude, make use of it.