business-logic-vuln — Claude Code skill: how to install
Routes security testing toward business logic and state machine flaws. Focuses on race conditions, stacked discounts, quota bypasses, and workflow abuse.
npx skills add yaklang/hack-skills --skill business-logic-vuln -a claude-codeWhat business-logic-vuln does
This skill serves as an entry P1 category router for assessing business logic weaknesses. Instead of searching for parser injections, it directs attention to state transitions and the exact moments checks execute. It focuses on workflows like coupons, payments, inventory reservations, quotas, invites, and trial periods.
The recommended flow starts with mapping key business states and one-time actions. Next, it looks for check-then-act windows, missing cross-step authorization, and sequence dependencies. When an attack chain depends on raw API endpoints or file permissions, it refers out to api-sec, auth-sec, or file-access-vuln.
The guide will not help with simple payload injections, because it targets state-machine logic and business rules exclusively.
What it helps with
- identify race conditions in quota and inventory updates
- spot negative balance and price tampering vulnerabilities
- test multi-step workflows for missing sequence authorization
- detect stacked discount and coupon abuse flaws
Example prompts for the agent
- Audit our checkout workflow for race conditions and stacked coupon logic.
- Trace the order state machine to check for sequence bypasses and negative amounts.
How to install business-logic-vuln
1Skills CLI (Vercel)
npx skills add yaklang/hack-skills --skill business-logic-vuln -a claude-code2Manually: put the files in place
~/.claude/skills/business-logic-vuln/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/business-logic-vuln/
1Skills CLI (Vercel)
npx skills add yaklang/hack-skills --skill business-logic-vuln -a codex2Manually: put the files in place
.agents/skills/business-logic-vuln/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add yaklang/hack-skills --skill business-logic-vuln -a cursor2Manually: put the files in place
.cursor/skills/business-logic-vuln/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install yaklang/hack-skills business-logic-vuln2Manually: put the files in place
.github/skills/business-logic-vuln/SKILL.md1Skills CLI (Vercel)
npx skills add yaklang/hack-skills --skill business-logic-vuln -a gemini-cli2Platform CLI
gemini skills install https://github.com/yaklang/hack-skills --path skills/business-logic-vulnManually: put the files in place
.devin/skills/business-logic-vuln/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add yaklang/hack-skills --skill business-logic-vuln -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about business-logic-vuln
How to install business-logic-vuln in Claude Code?
Run npx skills add yaklang/hack-skills --skill business-logic-vuln -a claude-code in your terminal.
What does the business-logic-vuln skill do?
It acts as a router for testing state machines, price tampering, race conditions, and sequence dependencies across business workflows.
Which related categories connect to this skill?
It links directly to business-logic-vulnerabilities and routes to api-sec, auth-sec, or file-access-vuln when attack chains involve APIs or file permissions.
Source text
SKILL.md · MIT
--- name: business-logic-vuln description: >- Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection. --- # Business Logic Router This is the routing entry point for business-logic and state-machine issues. ## When to Use - The target involves coupons, inventory, payment, approvals, quotas, invites, trials, or state transitions - The issue is not parser-level; it is about when checks happen and which business conditions are checked - You suspect race conditions, workflow bypass, price tampering, negative values, stacked discounts, or multi-step flaws ## Skill Map - [Business Logic Vulnerabilities](../business-logic-vulnerabilities/SKILL.md) ## Recommended Flow 1. First map key business states and one-time actions 2. Then check for check-then-act windows, sequence dependencies, or missing cross-step authorization 3. If the chain depends on APIs, uploads, or object permissions, return to the corresponding router skill to complete the path ## Related Categories - [api-sec](../api-sec/SKILL.md) - [auth-sec](../auth-sec/SKILL.md) - [file-access-vuln](../file-access-vuln/SKILL.md)
© yaklang · MIT · yaklang/hack-skills
