php-logic-audit

Name: php-logic-audit
Availability: InStock
Author: 0xShe

Identify and report business-logic flaws in PHP applications.

386|38|Updated Mar 24, 2026

Search Tags:#php #poc #security-audit #race-conditions #mass-assignment #authorization-bypass #logic-flaws

Ready to run

npx skills add https://github.com/0xShe/PHP-Code-Audit-Skill --skill php-logic-audit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: php-logic-audit
Source: https://github.com/0xShe/PHP-Code-Audit-Skill/tree/main/php-logic-audit
Command: npx skills add https://github.com/0xShe/PHP-Code-Audit-Skill --skill php-logic-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identifies and reports business-logic flaws in PHP applications, focusing on authentication/authorization gaps, Mass Assignment, workflow bypass, race conditions, and inconsistent state handling.

Core Features & Use Cases

Detects mass assignment vulnerabilities and privilege escalation in PHP models.
Traces business workflows to uncover bypass paths, TOCTOU risks, and timing-related issues.
Produces evidence chains, severity levels, PoCs, and remediation guidance for audits and fixes.

Quick Start

Run the php-logic-audit against a PHP project to detect and report business-logic flaws with evidence and recommendations.

Frequently Asked Questions about php-logic-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find business logic flaws in PHP applications?▼

To find business logic flaws in PHP applications, trace data flows and state changes across authentication, authorization, and workflows to collect evidence of mass assignment, race conditions, and timing issues.

What is a mass assignment vulnerability in PHP and how do I detect it?▼

A mass assignment vulnerability in PHP occurs when user input binds directly to model attributes, allowing privilege escalation. Detect it by tracing data flows to identify unguarded properties and generating proof-of-concept payloads.

How do I test for race conditions and TOCTOU risks in PHP workflows?▼

Testing for race conditions and TOCTOU risks in PHP workflows involves tracing timing-sensitive state transitions to uncover bypass paths, collecting evidence of inconsistent state handling, and delivering remediation guidance.

Can I audit authorization bypass and privilege escalation in PHP codebases?▼

Yes, you can audit authorization bypass and privilege escalation in PHP codebases by tracing business workflows to identify unvalidated state transitions and gaps in authentication checks, producing severity levels and fixes.

What is the best way to generate PoCs and remediation guidance for PHP security audits?▼

The best way to generate PoCs and remediation guidance for PHP security audits is to trace data flows and state changes to collect evidence chains, then deliver severity levels and targeted fixes for identified logic flaws.