Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →transilienceai/web-app-logic
Web application logic testing - business logic flaws, race conditions, access control, cache poisoning/deception, and information disclosure.
Passed 22 of 22 test cases with the skill, and 21 of 22 without it.
1 fixed21 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
A tenant admin on a multi-tenant SaaS platform changes the request parameter `tenant_id=company_a` to `tenant_id=company_b` in an endpoint updating organization preferences. If the server updates Company B's record without validating session ownership, what specific type of access control breach occurred?
| Checked | Without skill | With skill |
|---|---|---|
| Classifies the vulnerability as horizontal privilege escalation | Missed | Passed |
The instructions your model reads when the skill loads.
Test for logic flaws and application-specific vulnerabilities that automated scanners miss.
| Type | Key Vectors |
|---|---|
| Business Logic | Workflow bypass, price manipulation, feature abuse |
| Race Conditions | TOCTOU, limit bypass, double-spend, parallel requests |
| Access Control | IDOR, horizontal/vertical privilege escalation, forced browsing |
| Cache Poisoning | Unkeyed headers/parameters, fat GET, response splitting |
| Cache Deception | Path confusion, static extension tricks, normalization |
| Info Disclosure | Error messages, debug endpoints, source code, metadata |
reference/business-logic*.md - Business logic testing techniquesreference/race-conditions*.md - Race condition exploitationreference/access-control*.md - Access control bypass methodsreference/web-cache-poisoning*.md - Cache poisoning techniquesreference/web-cache-deception*.md - Cache deception attacksreference/information-disclosure*.md - Information disclosure testingtest cases passed, vs 21 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.