skills.rest
florianbuetow
florianbuetowCOMMUNITY
Explore all skills by this author →
Website𝕏@bytetweetsGitHub

business-logic

Analyzes application business logic for security vulnerabilities such as workflow bypassing and time-based exploits.

12|1|Updated Feb 9, 2026
Search Tags:#workflow#security#vulnerability#audit#business logic#exploit
One-click install
npx skills add https://github.com/florianbuetow/claude-code --skill business-logic
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: business-logic
Source: https://github.com/florianbuetow/claude-code/tree/main/plugins/appsec/skills/business-logic
Command: npx skills add https://github.com/florianbuetow/claude-code --skill business-logic

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill identifies and helps fix critical security vulnerabilities hidden within your application's core business logic, preventing financial loss, workflow bypasses, and other business-impacting exploits.

Core Features & Use Cases

  • Workflow Bypass Detection: Finds ways attackers can skip essential steps in processes like checkout or verification.
  • Numeric Manipulation Audits: Detects flaws where negative amounts or invalid quantities can be exploited.
  • Coupon & Referral Abuse Analysis: Uncovers vulnerabilities in discount systems and referral programs.
  • State Machine Integrity Checks: Ensures that entities can only transition through valid states.
  • Time-Based Exploit Identification: Locates logic flaws related to incorrect handling of time, timezones, or deadlines.
  • Use Case: An e-commerce site is losing money due to a bug allowing users to apply multiple coupons. This Skill can analyze the coupon application logic to find and suggest a fix for this vulnerability.

Quick Start

Analyze the current code for business logic security flaws, focusing on payment and checkout workflows.

Frequently Asked Questions about business-logic

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is business logic vulnerability analysis and why is it needed?▼

Business logic vulnerability analysis identifies security flaws in application workflows, such as bypassing checkout steps or manipulating negative amounts, preventing financial loss and process exploitation.

How do I audit my application code for coupon abuse and workflow bypass vulnerabilities?▼

You can audit application workflows for coupon abuse and step bypassing by analyzing the core logic with specific flags like --depth deep and --scope to target specific files or processes.

Can this detect time-based logic exploits and state machine manipulation flaws?▼

Yes, it analyzes business logic to identify time-based logic exploits involving incorrect timezones or deadlines, and ensures state machine integrity by verifying valid entity state transitions.

Does this analysis reference specific CWEs for business logic security flaws?▼

Yes, the analysis references specific CWEs including CWE-840 and CWE-841 to categorize and address business logic vulnerabilities like workflow step bypassing and state machine manipulation.

What is the best way to target specific payment or checkout workflows for a security audit?▼

The best way to target specific payment workflows is by using the --scope flag to limit the security analysis to designated files or processes, ensuring a focused vulnerability audit.

Limitations of automated business logic security audits?▼

Automated business logic audits require precise scoping via flags like --scope to be effective, meaning untargeted scans might miss context-specific vulnerabilities hidden deep within complex application workflows.

Related Skills

Explore More Software Engineering Skills→
giang6283623giang6283623
4

threat-model-security-review

Perform threat-model-led security reviews of source code, APIs, and authentication logic.

Community
Advanced
ersinkocersinkoc
56

sc-business-logic

Detect business logic vulnerabilities in web checkout and payment workflows.

Community
Advanced
ok-helloworldok-helloworld
241

business-agent

Detect business-logic vulnerabilities in web applications and APIs via HTTP testing.

Community
Advanced
EntroVyxEntroVyx
3

bug-bounty

Orchestrate reconnaissance, vulnerability research, and exploit chain development for authorized bug bounty programs.

Community
Advanced