business-logic

Business logic / authentication bypass / privilege escalation — POST body field tampering (role/is_admin/user_type), 2FA bypass via response manipulation, predictable TOTP seeds, hidden authorization headers, multi-step workflow tampering. For challenges tagged business_logic, privilege_escalation, 2fa_bypass, or auth_bypass that aren't pure IDOR/JWT.

Quality

95%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

90%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, executable CTF playbook with excellent conciseness and actionability, a clear decision-tree workflow, and well-organized sections. It loses only a point on workflow clarity (implicit rather than explicit validation checkpoints) and progressive disclosure (monolithic single file with no external references).

Suggestions

Add an explicit per-attack validation checkpoint — e.g., after each section's probe loop, a one-line 'Success indicator: HTTP 200/302 to /admin or response containing flag/admin/role' — to turn the implicit grep/http_code checks into structured validate→fix→retry feedback loops and lift workflow_clarity to 5.

For progressive_disclosure, consider splitting the large enumerated probe lists (the 9-field privilege loop, the 9-header list, the 7-method list) into a references/wordlists.md file referenced from each section, keeping SKILL.md as a lean overview while preserving the copy-paste lists one level deep.

Add a short 'Confirm exploitation succeeded' step to the Decision Tree terminal branch so the workflow closes with verification rather than ending at 're-read challenge description'.

Dimension	Reasoning	Score
Conciseness	Lean throughout — minimal purposeful prose ('When registration/profile endpoints accept arbitrary JSON, the server may read trusted privilege flags'), no explaining of concepts Claude already knows (what 2FA/curl are), and dense bash loops where every token earns its place, matching the score-5 anchor.	5 / 5
Actionability	Fully executable, copy-paste-ready bash: enumerated field/header/method lists, concrete wordlist paths (rockyou.txt, seclists), exact hydra invocation, and a commented pyotp one-liner — placeholders like <TARGET> are necessary parameterization, not pseudocode, matching the score-5 anchor.	5 / 5
Workflow Clarity	A numbered Decision Tree sequences the approaches (registration → 2FA → /admin → workflow → brute-force → re-read) and per-probe status checks exist via `-w '%{http_code}'` and grep indicators, but validation is implicit rather than explicit structured checkpoints, and there is no crisp validate→fix→retry loop per attack — placing it just above the score-3 batch-cap concern at 4.	4 / 5
Progressive Disclosure	Clean section headers (## 1–6), a Decision Tree, and an Anti-pattern note give good navigation, and no content obviously belongs in a separate file; however it is a monolithic 144-line single file with no one-level-deep references, so it sits at 4 rather than the reference-structured 5.	4 / 5
	Total	18 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A tight, highly specific description that concretely enumerates the skill's attack techniques, gives explicit trigger-tag guidance, and draws a clear boundary against IDOR/JWT skills. No fluff, no over-claims, third-person voice throughout.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'POST body field tampering (role/is_admin/user_type)', '2FA bypass via response manipulation', 'predictable TOTP seeds', 'hidden authorization headers', 'multi-step workflow tampering' — with comprehensive coverage of the business-logic exploitation domain, matching the score-5 anchor.	5 / 5
Completeness	Explicitly answers both 'what' (the enumeration of tampering/bypass techniques) and 'when' ('For challenges tagged business_logic, privilege_escalation, 2fa_bypass, or auth_bypass that aren't pure IDOR/JWT'), with concrete trigger phrases in third person.	5 / 5
Trigger Term Quality	Dense with natural CTF trigger terms and synonyms — 'business logic', 'privilege escalation', '2fa bypass', 'auth bypass', 'role manipulation', 'is_admin', 'user_type', 'totp', 'predictable code', 'response tampering', 'X-Forwarded-User', 'multi-step workflow' — that a user would naturally say, matching comprehensive coverage.	5 / 5
Distinctiveness Conflict Risk	Clear niche (business-logic/auth-bypass exploitation) with distinct triggers and an explicit exclusion boundary ('that aren't pure IDOR/JWT') that minimizes overlap with sibling IDOR/JWT skills.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/business-logic/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.