Detect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack scenarios), batched verify (check exploitable gaps in parallel subagents, 3 scenarios each), and merge (consolidate batch results). Covers price manipulation, workflow bypass, limit violations, race conditions, reward abuse, etc. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/businesslogic-results.md.
SkillScore73Maintained
Automatic
◆Security & AppSec pack
Last verified 8/14/2026
What it changes
Passed 15 of 20 test cases with the skill, and 5 of 20 without it.
Without skill27%
With skill73%
Checks it passed that the model alone missed
Divides the 8 scenarios into 3 parallel batches.
Deletes sast/businesslogic-threats.md upon completion.
Requires entitlement re-evaluation at feature access time.
and 13 more in the full report
11 fixed5 passed either way5 still failing1 broke
Pass-rate lift
+45 pp
Tokens
+257%
Agent turns
0%
Response time
-37%
Model gemini-3.6-flashMeasured 8/14/2026v116 of 22 cases passed with skill · 20 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 11 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 11
Prompt
Once Phase 2 verification subagents complete and all findings are merged into the final business logic results report, what cleanup actions must be performed on the intermediate markdown files?
What was checked, without and with the skill
Checked
Without skill
With skill
Deletes sast/businesslogic-threats.md upon completion.
Missed
Passed
Deletes all intermediate batch files matching sast/businesslogic-batch-*.md.
Missed
Passed
case-10 · gemini-3.6-flash · 8/14/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md363 linessingle file
Business Logic Vulnerability Detection
You are performing a focused security assessment to find business logic vulnerabilities in a codebase. This skill uses a three-phase approach with subagents: threat modeling (understand the domain and generate attack scenarios), batched verify (check whether scenarios are exploitable in parallel batches of 3), and merge (consolidate batch results).
Prerequisites: sast/architecture.md must exist. Run the analysis skill first if it doesn't.
What are Business Logic Vulnerabilities
Business logic vulnerabilities arise when an application's intended workflow, rules, or constraints can be manipulated to produce unintended outcomes — without exploiting technical flaws like injection or memory corruption. The attacker operates within the application's own features but uses them in ways the developers did not anticipate.
The core pattern: the application accepts input that is syntactically valid and passes authentication/authorization, but violates a business rule that was never enforced in code.
What Business Logic Vulnerabilities ARE
Submitting a negative quantity to a purchase endpoint, receiving a credit instead of a charge
Applying the same one-time discount coupon multiple times in parallel requests
Skipping the payment step in a multi-step checkout by replaying a later step's request
Posting a rating of 9999 to a movie rating endpoint that should cap ratings at 5
Transferring a negative amount to move money from the recipient to the sender
Redeeming a referral bonus by referring yourself with a second account
Re-using a single-use reset token or voucher that was never invalidated
Purchasing an item that is out of stock due to a race condition between inventory check and reservation
Accessing a premium subscription feature after downgrading to a free plan
Winning an auction by retracting a high bid after others have been eliminated
What Business Logic Vulnerabilities are NOT
Do not flag these as business logic issues:
SQL injection, XSS, RCE, XXE, SSRF, SSTI: These are injection/technical flaws — separate skills cover them
Missing authentication: Endpoint requires no login at all → that's "Unauthenticated Access"
IDOR: Accessing another user's resource by changing an ID → that's a separate access-control class
Brute-force / rate limiting: Generic rate-limit bypass on login → that's not a business logic flaw unless it enables specific business rule circumvention