Individual skill

ipa-security-check

IPA「安全なウェブサイトの作り方改訂第7版」「安全なSQLの呼び出し方」「ウェブ健康診断仕様」「セキュリティ実装チェックリスト」「安全なウェブサイトの運用管理に向けての20ヶ条」に基づき、ソースコードを静的に検査して脆弱性候補を検出する。発見した問題には IPA 原典の出典 (文書名・章・ページ・URL) を必ず付与する。

skills/ipa-security-check/SKILL.md

Read pinned source

Source commit fa5aaff030fb10863c408095735c630f8c002860

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: No
Observed behavior: Not checked yet
Last checked: Nov 4, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 973
Repository last updated: Aug 7, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 11,702 bytes
agents/01-sql-injection.mddoc · 3,498 bytes
agents/02-os-command-injection.mddoc · 3,565 bytes
agents/03-directory-traversal.mddoc · 3,700 bytes
agents/04-session-management.mddoc · 3,576 bytes
agents/05-xss.mddoc · 3,716 bytes
agents/06-csrf.mddoc · 3,684 bytes
agents/07-http-header-injection.mddoc · 3,674 bytes
agents/08-mail-header-injection.mddoc · 3,675 bytes
agents/09-clickjacking.mddoc · 3,520 bytes
agents/10-buffer-overflow.mddoc · 3,636 bytes
agents/11-access-control.mddoc · 3,711 bytes
agents/15-false-positive-review.mddoc · 5,885 bytes
agents/operation-checklist.mddoc · 3,858 bytes
agents/safe-sql-details.mddoc · 3,759 bytes
agents/web-health-check.mddoc · 3,573 bytes
commands/ipa-security-check.mddoc · 3,185 bytes
knowledge/01_sql_injection.mddoc · 10,644 bytes
knowledge/02_os_command_injection.mddoc · 8,284 bytes
knowledge/03_directory_traversal.mddoc · 7,997 bytes
knowledge/04_session_management.mddoc · 12,480 bytes
knowledge/05_xss.mddoc · 12,388 bytes
knowledge/06_csrf.mddoc · 11,712 bytes
knowledge/07_http_header_injection.mddoc · 8,097 bytes
knowledge/08_mail_header_injection.mddoc · 9,631 bytes
knowledge/09_clickjacking.mddoc · 9,743 bytes
knowledge/10_buffer_overflow.mddoc · 10,112 bytes
knowledge/11_access_control.mddoc · 14,290 bytes
knowledge/_sources.mddoc · 7,760 bytes
knowledge/operation_checklist.mddoc · 32,423 bytes
knowledge/safe_sql_details.mddoc · 29,575 bytes
knowledge/web_health_check.mddoc · 22,452 bytes
lib/orchestrator.mddoc · 13,715 bytes
lib/output_formatter.mddoc · 7,278 bytes
lib/scope_resolver.mddoc · 3,309 bytes
lib/shard_planner.mddoc · 4,252 bytes
lib/triage_state.mddoc · 6,725 bytes
rules/access_control.yamlasset · 8,410 bytes
rules/buffer_overflow.yamlasset · 6,469 bytes
rules/clickjacking.yamlasset · 4,027 bytes
rules/csrf.yamlasset · 6,504 bytes
rules/directory_traversal.yamlasset · 8,698 bytes
rules/http_header_injection.yamlasset · 5,472 bytes
rules/mail_header_injection.yamlasset · 5,243 bytes
rules/operation_checklist.yamlasset · 13,877 bytes
rules/os_command_injection.yamlasset · 9,498 bytes
rules/safe_sql_details.yamlasset · 8,261 bytes
rules/session_management.yamlasset · 8,806 bytes
rules/sql_injection.yamlasset · 14,208 bytes
rules/web_health_check.yamlasset · 10,967 bytes
rules/xss.yamlasset · 10,675 bytes
scripts/render_report.pyruns · 13,539 bytes
scripts/snippet_hash.pyruns · 2,391 bytes
templates/report.md.tmplasset · 3,750 bytes
templates/sarif.json.tmplasset · 1,064 bytes

Read excerpt


# IPA Security Check Skill

## このスキルが行うこと

IPA (情報処理推進機構) が公開する以下 5 資料の指摘事項に基づき、ローカルリポジトリのソースコード・設定ファイルを静的検査し、脆弱性候補を検出する。

| 略称 | 正式名称 | 主な検査内容 |
|---|---|---|
| SWS | 安全なウェブサイトの作り方 改訂第7版 | 11脆弱性 (SQLi/OSコマンド/トラバーサル/セッション/XSS/CSRF/HTTPヘッダ/メールヘッダ/クリックジャッキング/BoF/アクセス制御) |
| SQL | 安全なSQLの呼び出し方 | プレースホルダ使い分け・LIKE述語・識別子検証・文字コード問題 |
| WHC | ウェブ健康診断仕様 | 13診断項目のうち静的解析でカバー可能な観点 |
| OPS | 安全なウェブサイトの運用管理に向けての20ヶ条 | HTTPヘッダ・依存ライブラリ・設定ファイル類 |
| CL | セキュリティ実装チェックリスト | 改訂第7版 p.105-108 のチェックリスト |