Name: business-logic-vuln
Author: yaklang

Imported from yaklang/hack-skills (skills/business-logic-vuln/SKILL.md) via skills.sh. Install upstream with npx skills add yaklang/hack-skills --skill business-logic-vuln. Copyright stays with the author.

Business Logic Router

This is the routing entry point for business-logic and state-machine issues.

When to Use

The target involves coupons, inventory, payment, approvals, quotas, invites, trials, or state transitions
The issue is not parser-level; it is about when checks happen and which business conditions are checked
You suspect race conditions, workflow bypass, price tampering, negative values, stacked discounts, or multi-step flaws

Skill Map

Business Logic Vulnerabilities

Recommended Flow

First map key business states and one-time actions
Then check for check-then-act windows, sequence dependencies, or missing cross-step authorization
If the chain depends on APIs, uploads, or object permissions, return to the corresponding router skill to complete the path

Related Categories

# after Install: the listing is in your workspace's routing pool - a plan picks it for its slot curl -s -X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}'

Install business-logic-vuln and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "yaklang-hack-skills-business-logic-vuln", "kind": "skill", "name": "business-logic-vuln", "description": "Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection.", "publisher": "yaklang", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/yaklang/hack-skills", "path": "skills/business-logic-vuln/SKILL.md", "ref": "HEAD", "url": "https://www.skills.sh/yaklang/hack-skills/business-logic-vuln", "key": "yaklang/hack-skills/skills/business-logic-vuln/SKILL.md" } }, "instructions": "# Business Logic Router\n\nThis is the routing entry point for business-logic and state-machine issues.\n\n## When to Use\n\n- The target involves coupons, inventory, payment, approvals, quotas, invites, trials, or state transitions\n- The issue is not parser-level; it is about when checks happen and which business conditions are checked\n- You suspect race conditions, workflow bypass, price tampering, negative values, stacked discounts, or multi-step flaws\n\n## Skill Map\n\n- [Business Logic Vulnerabilities](../business-logic-vulnerabilities/SKILL.md)\n\n## Recommended Flow\n\n1. First map key business stat", "cost": { "context_tokens": 248 } }

business-logic-vuln

About

Business Logic Router

When to Use

Skill Map

Recommended Flow

Related Categories

Use it

Install business-logic-vuln and it becomes one more candidate the router can pick - when it fits.

Manifest

Reviews