skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

business-logic

Map state transitions and test invariant enforcement in business-logic workflows.

Updated Jul 30, 2026
Search Tags:#workflow#security#validation#business-logic#pentest#state-machine
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill business-logic-salmanabdurrahman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: business-logic
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/business-logic
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill business-logic-salmanabdurrahman

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the critical need to verify that application business logic, such as pricing, state transitions, and quota management, is enforced server-side rather than relying on client-side trust.

Core Features & Use Cases

  • State-Machine Mapping: Visualizes and tests multi-step workflows to identify bypass vulnerabilities like skip-step or step-replay attacks.
  • Invariant Validation: Ensures that business rules—such as price integrity, coupon limits, and quota atomicity—remain consistent under various test conditions.
  • Use Case: Use this skill to audit a checkout process to ensure that a user cannot skip the payment step or manipulate the final price by modifying request parameters.

Quick Start

Use the business-logic skill to map the state machine and validate price integrity for the checkout workflow on the target application.

Frequently Asked Questions about business-logic

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test business logic vulnerabilities in a multi-step workflow?▼

To test business logic vulnerabilities, you map state transitions and test invariant enforcement against unauthorized manipulation. This identifies bypass risks like skip-step or step-replay attacks in multi-step processes.

What is state-machine mapping for security assessments?▼

State-machine mapping visualizes multi-step workflows to identify bypass vulnerabilities during security assessments. It tests whether business rules like pricing, quotas, and coupon limits remain consistent under various unauthorized manipulation attempts.

How do I validate price integrity and prevent client-side manipulation during checkout?▼

You validate price integrity by ensuring business rules are enforced server-side rather than relying on client-side trust. Invariant validation tests price consistency and coupon limits against modified request parameters to prevent manipulation.

Can I audit coupon limits and quota atomicity using invariant validation?▼

Yes, invariant validation ensures business rules like coupon limits and quota atomicity remain consistent under various test conditions. It verifies that application business logic is properly enforced server-side against unauthorized manipulation.

Do I need an authorized test account to perform business logic pentesting?▼

Yes, business logic pentesting requires strict adherence to authorized test-account isolation and documented scope boundaries. This ensures safe, non-destructive validation of workflow integrity and state transitions during security assessments.

When should I not use business logic validation for security testing?▼

You should not use business logic validation without strict adherence to documented scope boundaries and authorized test-account isolation. Safe validation requires non-destructive testing within these constraints to avoid unauthorized manipulation of live workflows.

Related Skills

Explore More Software Engineering Skills→
gullitmirandagullitmiranda
2

workspace-status

Generate a per-repo status overview for multi-repo git workspaces.

Community
Intermediate
harperaaharperaa
15

business-logic-flaws-ai-generated-code

Detect race conditions and business-logic vulnerabilities in AI-generated code.

Community
Intermediate
prashsubprashsub
1

01-grain-definition

Define fact table grain types and document primary keys in YAML schemas.

Community
Intermediate
pdparchitectpdparchitect
13

hunt-business-logic

Identify and validate business logic vulnerabilities in web applications.

Community
Advanced