What makes business logic flaws different from standard vulnerabilities?

Business logic flaws are unique to an application's specific rules and workflows, making them invisible to generic automated scanners that look for common code patterns like SQL injection or XSS.

Can this skill detect price manipulation in e-commerce apps?

Yes, it specifically analyzes checkout and payment logic to ensure prices and quantities cannot be manipulated by the client or bypassed through workflow errors.

Which frameworks or languages does this skill support?

This skill is language-agnostic as it focuses on the logic and workflow patterns within your codebase, though it can integrate with tools like Semgrep for enhanced pattern matching.

How does the 'deep depth' analysis work?

When set to deep depth, the skill traces full workflow paths from initiation to completion, checking all possible state transitions and their security guards across multiple files.

Business Logic Security Auditor

Name: Business Logic Security Auditor
Author: florianbuetow

byflorianbuetow

•

セキュリティとテスト

Analyzes application workflows and business rules to identify logic-based security vulnerabilities that automated scanners often miss.

The Business Logic Security skill empowers Claude to perform deep-dive audits of complex application workflows, identifying critical flaws such as payment manipulation, discount abuse, and unauthorized state transitions. By mapping multi-step processes like checkouts and referral programs, it detects subtle vulnerabilities where technical implementation meets business rules, ensuring that financial operations, user states, and time-sensitive logic remain secure against exploitation. This skill is essential for developers building fintech, e-commerce, or any state-driven application where logical integrity is as critical as code safety.

主な機能

01Analysis of time-based logic and race conditions in business rules

02Identification of workflow step bypassing in multi-stage processes

03Detection of negative amount and price manipulation exploits

04Audit of coupon, discount, and referral system logic for abuse patterns

056 GitHub stars

06Validation of state machine integrity and unauthorized status transitions

ユースケース

01Verifying that state-sensitive workflows, like order fulfillment, cannot be bypassed or manipulated

02Auditing an e-commerce checkout flow to prevent coupon stacking or price tampering

03Securing a referral program against self-referral and circular reward chains

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add florianbuetow/claude-code business-logic

For use in Claude.ai and ChatGPT

Download Skill