skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

business-logic-vuln

Detect business workflow abuse vulnerabilities across multi-step state-machine flows.

241|28|Updated May 20, 2026
Search Tags:#authorization#pricing#race condition#business logic#state machine#workflow abuse#multi-step testing
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill business-logic-vuln-ok-helloworld
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: business-logic-vuln
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/business-logic-vuln
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill business-logic-vuln-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It helps you detect vulnerabilities that arise from business workflows, state transitions, and check-then-act logic rather than simple request parsing or input validation.

Core Features & Use Cases

  • Business-state and workflow testing: validate how coupons, inventory, quotas, trials, approvals, invites, and payment flows behave across steps.
  • Multi-step authorization and sequencing checks: identify missing cross-step permission enforcement and sequence dependencies.
  • Race condition and state-machine flaw hunting: uncover windows where timing, ordering, or repeated actions enable bypasses, pricing tampering, or stacked discount issues.

Example: If a site applies coupon checks during checkout but fails to re-validate eligibility after an earlier state change, this skill guides you to test the entire flow for workflow abuse and state inconsistencies.

Quick Start

Use the business-logic-vuln skill to map key states and one-time actions for a target workflow, then test for check-then-act gaps, missing cross-step authorization, and race or sequence dependencies across the full multi-step path.

Frequently Asked Questions about business-logic-vuln

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test multi-step workflows for business logic vulnerabilities?▼

Race conditions in payment and checkout flows occur when timing or repeated actions enable bypasses. You can detect these state-machine flaws by testing windows where ordering or concurrent actions allow pricing tampering, stacked discounts, or quota bypasses.

What is a check-then-act flaw in state machine testing?▼

A check-then-act flaw in state machine testing happens when a system validates eligibility but fails to re-validate after a state change. This creates gaps in multi-step authorization, allowing users to abuse workflows like coupon applications or trial activations.

How do I find broken state transitions in API and UI workflows?▼

Yes, you can use business logic vulnerability testing for multi-step authorization and sequencing checks across both APIs and UI flows. It directs you to the correct downstream category when the chain depends on permissions, API calls, or uploads.

When should I test for workflow abuse in lifecycle actions?▼

You should test for workflow abuse in lifecycle actions when a multi-step flow involves coupons, inventory, quotas, trials, approvals, or invites. Testing is necessary to uncover sequence dependencies and timing windows that enable bypasses or state inconsistencies.

Related Skills

Explore More Software Engineering Skills→
trusted-americantrusted-american

xstate-statecharts

Model complex UI state machines with XState 5 and ember-statechart-component.

Official
Advanced
sayseven7sayseven7
11

business-logic-vuln

Identify business logic vulnerabilities in multi-step workflows and state transitions.

Community
Basic
jayjpatel9717jayjpatel9717

business-logic

Detect and analyze business logic vulnerabilities like race conditions and price manipulation.

Community
Advanced
Venkateshvenki404224Venkateshvenki404224
25

frappe-state-machine-helper

Generate state machine logic for Frappe DocTypes with transition validation and hooks.

Community
Intermediate