Skip to content
Security
Skill

/business-logic-vuln

Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection.

BOOST
@yaklangyaklang@yaklang
From plugin
hack-skills
2.6k103 skills

Claude Code

$ npx -y skills add yaklang/hack-skills --skill business-logic-vuln --agent claude-code

SKILL.md

business-logic-vuln.SKILL.md
name: business-logic-vuln
description: >-
  Entry P1 category router for business logic testing. Use when workflow abuse,
  race conditions, pricing flaws, or multi-step state attacks matter more than
  parser-level input injection.

Business Logic Router

This is the routing entry point for business-logic and state-machine issues.

When to Use

  • The target involves coupons, inventory, payment, approvals, quotas, invites, trials, or state transitions
  • The issue is not parser-level; it is about when checks happen and which business conditions are checked
  • You suspect race conditions, workflow bypass, price tampering, negative values, stacked discounts, or multi-step flaws

Skill Map

  • [Business Logic Vulnerabilities](../business-logic-vulnerabilities/SKILL.md)

Recommended Flow

1. First map key business states and one-time actions 2. Then check for check-then-act windows, sequence dependencies, or missing cross-step authorization 3. If the chain depends on APIs, uploads, or object permissions, return to the corresponding router skill to complete the path

Related Categories

  • [api-sec](../api-sec/SKILL.md)
  • [auth-sec](../auth-sec/SKILL.md)
  • [file-access-vuln](../file-access-vuln/SKILL.md)
Read it on GitHub ↗
Stats
PythonJavaScriptNodeHTMLJavaPHPSQLGraphQLKubernetesLinuxiOSAndroid
2,643
Stars
367
Forks
Maintained
Maintenance
CSS
Language
MIT
License
Last commit
Created

Repo: yaklang/hack-skills

In this plugin
103 skills
See everything inside
@yaklang
Ships withhack-skills

Master Entry → Category Entries → Deep Topic Skills One master entry, six category entries, and 102 deep topic skills across 14 security domains.

2.6k103 skills
Get the whole plugin

Stars on GitHub

Momentum

stars in total
2.6k
Star history of yaklang/hack-skills on GitHub, a chart by star-history.com
See what's trending this week

Other skills on hack-skills.

ai-ml-security

ai-ml-security

AI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples,…

hack-skills
@yaklang@yaklangInstall Skill
See all 103 skills in hack-skills

More skills from other plugins.

api-security

api-security

Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…

reverse-skill7w44k
@zhaoxuya520@zhaoxuya520Install Skill
nemoclaw-user-guide

nemoclaw-user-guide

Find official NemoClaw documentation for installation, configuration, operation, or troubleshooting. Also handles requested docs…

nemoclaw10d23k
@nvidia@nvidiaInstall Skill

Questions about business-logic-vuln.

Which coding agents can use business-logic-vuln?
business-logic-vuln installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.