Agent Skills
› yaklang/hack-skills
› business-logic-vuln
business-logic-vuln
GitHub业务逻辑漏洞测试的路由入口，针对优惠券、支付等场景中的竞态条件、工作流绕过及多步状态攻击进行检测，侧重业务流程而非输入解析。
Trigger Scenarios
涉及优惠券、库存、支付等业务逻辑的测试
怀疑存在竞态条件、工作流绕过或价格篡改
Install
npx skills add yaklang/hack-skills --skill business-logic-vuln -g -y
SKILL.md
Frontmatter
{
"name": "business-logic-vuln",
"description": "Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection."
}
Business Logic Router
This is the routing entry point for business-logic and state-machine issues.
When to Use
- The target involves coupons, inventory, payment, approvals, quotas, invites, trials, or state transitions
- The issue is not parser-level; it is about when checks happen and which business conditions are checked
- You suspect race conditions, workflow bypass, price tampering, negative values, stacked discounts, or multi-step flaws
Skill Map
Recommended Flow
- First map key business states and one-time actions
- Then check for check-then-act windows, sequence dependencies, or missing cross-step authorization
- If the chain depends on APIs, uploads, or object permissions, return to the corresponding router skill to complete the path
Related Categories
Version History
- c9a4b9e Current 2026-07-06 00:22
