Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-busl-06
Test Circumvention of Work Flows
Passed 11 of 22 test cases with the skill, and 11 of 22 without it.
and 1 more in the full report
2 fixed16 passed either way3 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
What CVSS rating and severity level is typically assigned when a user can re-apply a promotional discount code to an order after payment has already been processed?
| Checked | Without skill | With skill |
|---|---|---|
| Classifies post-payment discount application as High severity | Missed | Passed |
| Assigns a CVSS score of 7.5 to post-payment discount manipulation | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-BUSL-06
Testing for the Circumvention of Work Flows
Workflow circumvention testing examines whether an application properly enforces the intended sequence of steps in multi-step processes. Many business processes require specific steps to be completed in order (e.g., shopping cart → checkout → payment → confirmation). Attackers may attempt to skip steps, revisit completed steps, or access endpoints out of sequence to bypass security controls, avoid payments, or gain unauthorized access.
| Vulnerability | Example |
|---|---|
| Step skipping | Skip payment, go directly to order confirmation |
| Step repetition | Repeat discount application |
| State manipulation | Change order after payment |
| Direct access | Access confirmation page without completing flow |
| Parallel execution | Start multiple flows, complete one |
test cases passed, vs 11 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.