business-logic-vuln

Identify business-logic vulnerabilities in multi-step workflows with deterministic test scenarios.

1.6k|204|Updated Apr 7, 2026

Search Tags:#workflow #vulnerability #business-logic #security-testing #race-condition #check-then-act

Ready to run

npx skills add https://github.com/yaklang/hack-skills --skill business-logic-vuln

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: business-logic-vuln
Source: https://github.com/yaklang/hack-skills/tree/main/skills/business-logic-vuln
Command: npx skills add https://github.com/yaklang/hack-skills --skill business-logic-vuln

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the core issue of business logic flaws hidden in multi-step workflows, where outcomes depend on state, timing, and authorization checks rather than input parsing.

Core Features & Use Cases

Maps risks across coupons, inventory, pricing, approvals, quotas, invitations, and state transitions to reveal logic flaws.
Guides detection of check-then-act vulnerabilities, race conditions, and workflow bypasses that occur despite valid inputs.
Provides a structured approach to build deterministic test scenarios and reproduce real-world abuse paths safely.

Quick Start

Provide a step-by-step test plan to reproduce a race condition in a given business-process scenario.

Frequently Asked Questions about business-logic-vuln

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test business-logic vulnerabilities in multi-step workflows?▼

Race conditions in payment workflows are detected by targeting check-then-act validation windows. You enforce robust cross-step authorization assessment through deterministic test scenarios to safely reproduce real-world timing and sequencing errors.

What is a check-then-act vulnerability in application security?▼

A check-then-act vulnerability is a business-logic flaw where state changes occur between validation and execution. It arises in multi-step workflows when authorization or quota checks fail to enforce robust validation, allowing workflow bypasses despite valid inputs.

How do I bypass state transition checks in approval workflows?▼

You bypass state transition checks by identifying workflow bypasses and cross-step authorization flaws that occur despite valid inputs. Structured test scenarios map risks across approvals and quotas to reveal logic flaws safely.

Can I detect race conditions in coupon and inventory systems without valid inputs?▼

Yes, business-logic flaws occur despite valid inputs. You detect race conditions in coupon and inventory systems by targeting check-then-act windows and enforcing robust validation through deterministic test scenarios and pattern libraries.

What are the limitations of testing business-logic vulnerabilities?▼

Testing business-logic vulnerabilities requires understanding specific multi-step workflows involving coupons, approvals, and quotas. Limitations include safely reproducing real-world abuse paths without disrupting state transitions or triggering unintended cross-step authorization failures.