From appsec
This skill should be used when the user asks to "check business logic security", "find logic flaws", "audit workflow security", "check for coupon abuse", "detect negative amount exploits", "analyze state machine security", or mentions "business logic", "workflow bypass", "negative amount", "coupon abuse", "self-referral", "state manipulation", or "time-based exploit" in a security context.
npx claudepluginhub florianbuetow/claude-code --plugin appsecThis skill uses the workspace's default tool permissions.
Analyze application business logic for security vulnerabilities including
Acquire memory dumps from live systems/VMs and analyze with Volatility 3 for processes, networks, DLLs, injections in incident response or malware hunts.
Provides x86-64/ARM disassembly patterns, calling conventions, control flow recognition for static analysis of executables and compiled binaries.
Identifies anti-debugging checks like IsDebuggerPresent, NtQueryInformationProcess in Windows binaries; suggests bypasses via patches/hooks/scripts for malware analysis, CTFs, authorized RE.
Analyze application business logic for security vulnerabilities including workflow step bypassing, negative amount manipulation, coupon/discount abuse, self-referral exploitation, state machine manipulation, and time-based logic exploits. Business logic flaws are unique to each application and cannot be detected by generic scanners -- they require understanding the intended workflow and finding ways to subvert it.
Read ../../shared/schemas/flags.md for the full flag specification. This skill
supports all cross-cutting flags. Key flags for this skill:
--scope determines which files to analyze (default: changed)--depth standard reads code and checks business rule implementations--depth deep traces full workflows from initiation through completion--severity filters output (business logic issues are often high or critical)Key CWEs in scope:
Read references/detection-patterns.md for the full catalog of code patterns,
search heuristics, language-specific examples, and false positive guidance.
Parse flags and resolve the file list per ../../shared/schemas/flags.md.
Filter to files likely to contain business logic:
**/payments/**, **/checkout/**, **/billing/**)**/orders/**, **/cart/**, **/transactions/**)**/coupons/**, **/discounts/**, **/promotions/**)**/referrals/**, **/rewards/**, **/loyalty/**)**/workflows/**, **/state/**, **/status/**)**/accounts/**, **/profiles/**)Detect scanners per ../../shared/schemas/scanners.md:
semgrep -- custom rules can catch some business logic patternsRecord which scanners are available. Business logic flaws are primarily detected through manual code analysis, not automated scanners.
If semgrep is available, run with rules targeting business logic:
semgrep scan --config auto --json --quiet <target>
Filter for rules matching validation, state management, and numeric handling patterns. Normalize output to the findings schema.
This is the primary detection method for business logic flaws:
When --depth deep, additionally trace:
Format output per ../../shared/schemas/findings.md using the BIZ prefix
(e.g., BIZ-001, BIZ-002).
Include for each finding:
These are the high-signal patterns specific to business logic security. Each
maps to a detection pattern in references/detection-patterns.md.
Workflow step bypass -- Multi-step processes where a later step can be invoked directly without completing prior steps.
Negative amount manipulation -- Numeric inputs accepted without sign validation, allowing negative amounts to reverse charges or increase balances.
Coupon/discount abuse -- Discount codes applied multiple times, stacked beyond intended limits, or used on ineligible items.
Self-referral exploitation -- Referral reward systems that do not prevent users from referring themselves or creating fake referral chains.
State machine manipulation -- Invalid state transitions accepted by the system (e.g., marking an order as "delivered" before "shipped").
Time-based logic exploits -- Logic dependent on client-supplied timestamps, exploitable timezone handling, or deadline race conditions.
Price manipulation -- Client-supplied prices accepted without server-side verification against the product catalog.
Quantity abuse -- No limits on quantities enabling abuse (ordering negative quantities, exceeding stock, zero-quantity orders).
| Scanner | Coverage | Command |
|---|---|---|
| semgrep | Numeric validation, some state patterns | semgrep scan --config auto --json --quiet <target> |
Fallback (no scanner): Business logic flaws require manual code analysis.
Use Grep with patterns from references/detection-patterns.md to find
financial operations, state transitions, discount logic, and referral systems.
Report findings with confidence: medium.
Use the findings schema from ../../shared/schemas/findings.md.
BIZ (e.g., BIZ-001)business-logicspecializedBIZCWE-840, CWE-841A04:2021 (Insecure Design)T (Tampering) or E (Elevation of Privilege)Severity guidance for this category: