skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

business-agent

Detect business-logic vulnerabilities in web applications and APIs via HTTP testing.

241|28|Updated May 20, 2026
Search Tags:#race condition#business logic#workflow bypass#coupon abuse#pricing manipulation#CSRF bypass#pentest evidence
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill business-agent
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: business-agent
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/agents/business-agent
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill business-agent

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Detects business-logic vulnerabilities that look legitimate at the HTTP level but still let attackers bypass workflows, manipulate prices and quantities, abuse coupons, exploit race conditions, or perform advanced CSRF bypasses.

Core Features & Use Cases

  • Workflow and State-Machine Bypass: Validates whether attackers can skip, roll back, or otherwise reach illegal business states and still complete downstream actions.
  • Pricing/Quantity/Payment Manipulation: Tests boundary and variant payloads to confirm whether manipulated monetary and count fields are actually accepted by order/payment flows.
  • Race Condition & Advanced CSRF: Reproduces concurrency windows reliably and checks higher-order CSRF bypass scenarios that evade typical protections.

Quick Start

Use the business-agent to test an authorized target end-to-end for workflow bypass, pricing/stock/coupon manipulation, race conditions, and advanced CSRF bypass, then write findings with HTTP evidence using the required http_test.py tool.

Frequently Asked Questions about business-agent

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for business-logic vulnerabilities like workflow bypass and pricing manipulation during a black-box pentest?▼

Testing for race conditions in web application APIs reproduces concurrency windows by sending simultaneous manipulated requests to verify if boundary payloads bypass stock or payment limitations. It requires executing all HTTP requests through a dedicated script with response-evidence capture to reliably prove the concurrency impact.

What is a state-machine bypass and how does it impact end-to-end business workflows?▼

A state-machine bypass occurs when attackers skip, roll back, or reach illegal business states but still complete downstream actions. Identifying these flaws requires testing end-to-end front-end flows and API endpoints to confirm that manipulated state transitions are accepted by the application.

Can I use business-logic testing to reproduce race conditions and advanced CSRF bypass scenarios?▼

Yes, business-logic testing reproduces race conditions by validating concurrency windows and checks higher-order CSRF bypass scenarios that evade typical protections. It applies to authorized black-box penetration testing of web applications and APIs to prove real business impact across front-end flows.

Does business-logic vulnerability testing require preserving HTTP request and response evidence for replay?▼

Yes, business-logic testing requires preserving HTTP request and response headers and bodies for replay. All HTTP requests must be executed via a specific script with response-evidence capture to support multi-step chained verification of preconditions and postconditions across API endpoints.

What is the best way to verify subscription hijacking and payment manipulation vulnerabilities in APIs?▼

The best way to verify subscription hijacking and payment manipulation is through authorized black-box penetration testing that applies boundary and variant payloads to monetary fields. It confirms whether manipulated payment flows are actually accepted by testing API endpoints and capturing end-to-end HTTP evidence.

Related Skills

Explore More Software Engineering Skills→
ok-helloworldok-helloworld
241

misc-agent

Detect perimeter Web security weaknesses via structured HTTP testing.

Community
Advanced
grivera82grivera82

hunt-business-logic

Identify and document business-logic vulnerabilities in web applications.

Community
Advanced
cyberkaidacyberkaida
797

ctf-pwn

Identify memory corruption vulnerabilities in CTF binaries and outline exploitation plans.

Community
Advanced
jayjpatel9717jayjpatel9717

business-logic

Detect and analyze business logic vulnerabilities like race conditions and price manipulation.

Community
Advanced