business-logic-review
Review an authorized application for business-logic vulnerabilities, workflow abuse, approval bypasses, replay conditions, quota circumvention, plan enforcement bugs, and state-transition errors. Use
SKILL.mdskills/business-logic-review/SKILL.md
GitHubBusiness Logic Review
Focus
- state machine gaps
- approval or refund bypasses
- replay and duplicate processing
- quota and entitlement circumvention
- race conditions around credits, inventory, or invitations
- UI-only controls missing server-side enforcement
Method
- Identify the invariant the product is trying to preserve.
- Trace where the invariant is enforced.
- Look for alternate paths, retries, replays, and admin shortcuts.
- Confirm whether enforcement survives background jobs and webhooks.