Business Logic Vuln

This is your starting point when you need to test whether an application's business rules can be gamed rather than broken at the input layer. It routes you toward race conditions, workflow bypasses, pricing manipulation, and state machine abuse in systems that handle coupons, payments, approvals, or multi-step processes. The skill itself is a dispatcher, not a techniques library, so it points you to the actual business logic vulnerabilities skill and related routers for API, auth, and file access issues. Use it when the bug lives in the gap between "check" and "act" or when discount stacking and negative quantity tricks matter more than SQL injection.

skills.sh installs: 3.9K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill business-logic-vuln --agent claude-code

Installs into .claude/skills of the current project.

Files

Business Logic Router

This is the routing entry point for business-logic and state-machine issues.

When to Use

The target involves coupons, inventory, payment, approvals, quotas, invites, trials, or state transitions
The issue is not parser-level; it is about when checks happen and which business conditions are checked
You suspect race conditions, workflow bypass, price tampering, negative values, stacked discounts, or multi-step flaws

Skill Map

Business Logic Vulnerabilities

Recommended Flow

First map key business states and one-time actions
Then check for check-then-act windows, sequence dependencies, or missing cross-step authorization
If the chain depends on APIs, uploads, or object permissions, return to the corresponding router skill to complete the path