Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-busl-01
Test Business Logic Data Validation
Passed 18 of 22 test cases with the skill, and 13 of 22 without it.
and 2 more in the full report
5 fixed13 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
An auditor discovers an API endpoint allowing users to change their order status directly from 'pending' to 'shipped' without payment. What CVSS score and severity rating does WSTG-BUSL-01 assign to state transition bypass findings?
| Checked | Without skill | With skill |
|---|---|---|
| Assigns a CVSS score of 8.8 High to state transition bypass vulnerabilities. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-BUSL-01
Test Business Logic Data Validation
Business logic data validation testing examines whether the application correctly validates data according to business rules, not just technical constraints. While technical validation (data type, format, length) is often implemented, business-level validation (logical ranges, relationships, state transitions) may be missing. Attackers can exploit these gaps to submit data that is technically valid but violates business logic.
| Vulnerability | Example |
|---|---|
| Negative values | Negative quantity causing refund |
| Out-of-range | 200% discount |
| Logic bypass | Skipping required steps |
| Race conditions | Double spending |
| Integer overflow | Extreme values wrapping |
test cases passed, vs 13 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.