manual-decision-trees

Name: manual-decision-trees
Availability: InStock
Author: entrovyx

Generate structured decision-tree testing plans for manual offensive security workflows.

3|1|Updated Jul 2, 2026

Search Tags:#workflow #security #vulnerability #pentest #bug bounty #recon

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill manual-decision-trees

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: manual-decision-trees
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/meta/manual-decision-trees
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill manual-decision-trees

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the common pitfall of testing endpoints in isolation, helping security researchers move beyond surface-level scanning to uncover complex vulnerabilities hidden within business workflows.

Core Features & Use Cases

Structured Methodology: Provides a framework to explore actor, state, transport, and secondary-object branches for any given workflow.
Workflow-Centric Testing: Ensures comprehensive coverage by forcing the agent to consider how different users, states, and transport methods interact with the target.
Use Case: When auditing a new feature like a document export system, use this skill to systematically test the export function across different user roles, object states, and transport protocols to identify IDOR or business logic flaws.

Quick Start

Invoke the manual decision trees skill to generate a comprehensive testing plan for the current target workflow.

Frequently Asked Questions about manual-decision-trees

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

To find business logic and workflow vulnerabilities during a pentest, use a structured decision-tree framework to systematically evaluate authorization, state transitions, and object relationships across actor, state, transport, and secondary-object dimensions.▼

What is workflow-centric security testing and when do I need it?▼

Workflow-centric security testing evaluates how different users, states, and transport methods interact within a target system, and you need it when auditing complex features to uncover hidden IDOR or business logic flaws that isolated endpoint testing misses.

How do I systematically test authorization and state transitions for IDOR?▼

Systematically test authorization and state transitions for IDOR by applying a decision-tree methodology that forces you to explore actor permissions and object state changes across different transport protocols for comprehensive security coverage.

Does manual decision tree testing work for bug bounty recon?▼

Manual decision tree testing works effectively for bug bounty recon by providing a structured methodology to perform deep-hunt analysis on application workflows, moving beyond surface-level scanning to identify high-impact authorization vulnerabilities.

What is the best way to test a document export system for security flaws?▼

The best way to test a document export system for security flaws is to use a structured testing plan that systematically checks the export function across different user roles, object states, and transport protocols to identify authorization and logic bugs.