business-logic-vuln

Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection.

3,660
installs: 0 up / 0 down, score 0.00
votes: 2,523
repo stars
Updated: 1 month ago
In the catalog since: 1 Oct 2026
From: yaklang/hack-skills

Get it through your agent npx skills add yaklang/hack-skills@business-logic-vuln

Skill instructions

Rendered from the published SKILL.md, 25 lines.

Business Logic Router

This is the routing entry point for business-logic and state-machine issues.

When to Use

The target involves coupons, inventory, payment, approvals, quotas, invites, trials, or state transitions
The issue is not parser-level; it is about when checks happen and which business conditions are checked
You suspect race conditions, workflow bypass, price tampering, negative values, stacked discounts, or multi-step flaws

Skill Map

Business Logic Vulnerabilities

Recommended Flow

First map key business states and one-time actions
Then check for check-then-act windows, sequence dependencies, or missing cross-step authorization
If the chain depends on APIs, uploads, or object permissions, return to the corresponding router skill to complete the path

Related Categories

Get it through your agent

Call the Graph-of-Skills MCP server's retrieve_skill_bundle tool and it returns this skill's text inside your budget.

{
  "tool": "retrieve_skill_bundle",
  "arguments": {
    "query": "business-logic-vuln"
  }
}

New to this? Set up Graph-of-Skills or get a free key. The text on this page comes from its authors: how skills are sourced and what we check. If none fits your task, your agent can write a skill for your own library. To keep a skill from your own library on a machine, see how to install one of your skills.

Share on X Share on LinkedIn Share on Bluesky Share on Hacker News

Share on Reddit

Source

Source repository yaklang/hack-skills
Listing on skills.sh

From yaklang/hack-skills via skills.sh

Related skills

business-logic-vulnerabilities
Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps.
3,859 installs
file-access-vuln
Entry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview pipelines, archive extraction, or storage and sharing boundaries.
3,609 installs
gha-security-review
GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review .github/workflows/ for pwn requests, expression injection, credential theft, and supply chain attacks. Exploitation-focused with concrete PoC scenarios.
4,753 installs
find-security-vulnerabilities-in-code
Find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization model, then exploits what it finds in a live sandbox so every reported issue has a working proof-of-concept instead of a noisy static-analysis alert. Covers injection, XSS, SSRF, broken access control and IDOR, insecure deserialization, secrets in code, unsafe dependencies, and business-logic flaws. Use when the user asks to security-scan, security-review, or audit their code, repo, or pull request for vulnerabilities.
12,469 installs
lead-routing
Design the assignment logic that routes inbound leads to sales reps - rule precedence and waterfall ordering, lead-to-account matching, territory assignment rules (geography, segment, industry, named accounts), round-robin variants (straight, weighted, capacity-based, availability-aware), fallback catch-all queues, SLA escalation and reassignment, and safe rollout of routing changes. Use whenever the user mentions lead routing, lead assignment, territory assignment, round-robin, lead distribution, "who gets this lead", a lopsided round-robin, or leads sitting unworked in a CRM queue - even if they never say "routing". Covers B2B account-based and B2C/PLG high-volume routing. Do NOT use for designing the lead score itself - use mbfinotti/revops-skills@lead-scoring instead.
19,480 installs

More from yaklang/hack-skills

hack
Entry P0 primary router and operating doctrine for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit path planning, authorized pentest, code audit, source-leak mining, middleware audit, SOC triage, detection engineering, incident response, or choosing the right next category skill before any deep topic skill. Also use when the user mentions 安全工程师, 渗透测试, 红队, 蓝队, 代码审计, 源码泄露, SRC. Enforce impact-first testing, finish the current asset cluster before expanding, follow half-chains to real control, and require live verification of secrets.
4,313 installs
android-pentesting-tricks
Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and backup extraction during authorized mobile security assessments.
4,038 installs
sqli-sql-injection
SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.
3,994 installs
code-obfuscation-deobfuscation
Code obfuscation analysis and deobfuscation playbook. Use when reversing binaries protected by junk code, opaque predicates, self-modifying code, control flow flattening, VM protection, or string encryption.
3,992 installs
recon-and-methodology
Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing plan for a new target.
3,987 installs

Content is provided as published by its creators; you are responsible for how you use it.

To request removal, use the contact form.