What problem does it solve? Applications often enforce rules only in the UI or in individual requests, so every request looks valid while an unexpected sequence, value, or race violates product rules. This Skill turns product rules into machine-checkable invariants and provides concrete test recipes to prove or disprove real business-logic vulnerabilities without causing harm. ## Core Features & Use Cases - Invariant Modeling: Convert product rules (one-time actions, bounds, ownership, confirmations, sequence, concurrency) into testable statements before probing. - Test Recipes: Ready-made procedures for boundary mutation, fixed OTP values, parent/context swaps, race conditions on one-time actions, Unicode canonicalization bypasses, client-controlled authorization flags, and coupon replay. - Negative Controls: A stop-condition taxonomy (expected behavior, control elsewhere, theoretical without oracle, below impact threshold, duplicate root cause) that prevents filing non-reportable findings. - Use Case: While testing a ride-review endpoint, send an out-of-range rating value, then confirm via an authoritative read-back that the aggregate rating actually changed, proving a committed invariant violation rather than a UI anomaly. ## Quick Start Use the business-logic-hunter skill to model the invariants of this coupon redemption workflow and test whether it can be redeemed twice.
