skills.rest
ricardoo022
ricardoo022COMMUNITY
Explore all skills by this author →
GitHub

scan-fase-16

Map workflows and state transitions to identify business-logic vulnerabilities.

Updated Mar 11, 2026
Search Tags:#threat-modeling#workflows#business-logic#reverse-engineering#state-machine#security-testing#race-conditions
One-click install
npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-16
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: scan-fase-16
Source: https://github.com/ricardoo022/PentestAI-with-claude-code/tree/main/.claude/skills/scan-fase-16
Command: npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-16

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill enables security testers to uncover application-specific business-logic vulnerabilities by mapping critical workflows, validating state transitions, and testing how rules behave under real-world scenarios.

Core Features & Use Cases

  • Adaptive workflow mapping and state-machine analysis across diverse tech stacks (e.g., Supabase, Firebase, Django, FastAPI, Node.js, Rails, Spring, .NET, PHP, Go, or custom backends)
  • STRIDE-based threat modeling and behavioral analysis to identify fraud-prone flows, bypass opportunities, and validation gaps
  • End-to-end exploration that adapts to unique business rules, supports authenticated and unauthenticated paths, and documents findings with remediation guidance

Quick Start

Invoke with /scan-fase-16 {url} to start automated business-logic testing on the target application.

Frequently Asked Questions about scan-fase-16

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is business-logic vulnerability testing and how does state-machine analysis find flaws?▼

Business-logic vulnerability testing identifies application-specific flaws by mapping critical workflows, validating state transitions, and testing how rules behave under real-world scenarios to uncover fraud-prone flows and validation gaps.

How do I test checkout and pricing workflows for race conditions and authorization bypasses?▼

Test checkout and pricing workflows by mapping state transitions and validation points across target architectures, applying STRIDE-based threat modeling to reveal context-dependent flaws, bypass opportunities, and race conditions in business rules.

Can I perform threat modeling and security testing on Supabase, Firebase, or Django backends?▼

Yes, adaptive workflow mapping and security testing support diverse tech stacks including Supabase, Firebase, Django, FastAPI, Node.js, Rails, Spring, .NET, PHP, Go, and custom backends to identify context-dependent business-logic flaws.

What prerequisites are needed to start business-logic vulnerability scanning on a target URL?▼

Prerequisites for business-logic scanning include a reachable target URL and completed backend detection and reconnaissance phases, with additional phases recommended to ensure comprehensive workflow and state-machine analysis.

Does business-logic testing work for both authenticated and unauthenticated application paths?▼

Yes, end-to-end business-logic exploration adapts to unique business rules and supports both authenticated and unauthenticated paths, documenting findings with remediation guidance for validation gaps and fraud-prone flows.

Related Skills

Explore More Software Engineering Skills→
DorianGalloDorianGallo
5

recon-for-sec

Route reconnaissance workflows for mapping unknown target surfaces.

Community
Basic
matteocervellimatteocervelli
25

planning-doc-generator

Generate project assessment Markdown reports from structured JSON data.

Community
Intermediate
truongnattruongnat

senior-security

Perform STRIDE threat analysis and OWASP-guided vulnerability assessments.

Community
Advanced
RedHatProductSecurityRedHatProductSecurity
47

fuzzing-obstacles

Detect and modify anti-fuzzing code patterns in C, C++, and Rust projects.

Official
Advanced