CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

business-logic-testing

Test an authorized web application for business-logic flaws and race conditions — the classes scanners cannot find. Model invariants (conservation of value, uniqueness, monotonicity, exclusivity), build an Actor x Action x Resource matrix, abuse state machines (skip/reorder/replay steps, limit-slicing), find numeric bugs (float-vs-decimal rounding, cross-currency refund arbitrage, negative amounts), stale feature gates, and saga gaps; prove concurrency bugs (double-spend, lost update, idempotency-key reuse) with controlled parallel requests. Use when the user mentions 'business logic testing,' 'race condition,' 'double spend,' 'TOCTOU,' 'concurrency bug,' 'idempotency,' 'coupon reuse,' 'workflow bypass,' 'limit bypass,' 'negative amount,' 'refund arbitrage,' 'parallel request attack,' or 'logic flaw.'

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

92%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong, expert-level body: an invariant-first methodology with concrete probes, a rigorous per-class validation standard, and an appropriate split of detail into real, one-level-deep reference files. The only weakness is occasional re-explanation of concepts Claude already knows (lost-update semantics, isolation-level basics), which could be trimmed without losing testing-relevant specifics.

Suggestions

Trim the definitional halves of known-concept explanations — e.g. 'concurrent writers each start from the same read and the last write wins' and 'The default isolation level permits non-repeatable reads and write skew' — keeping only the testing angle (what probe lands in the window, what durable state proves it).

In Step 4, cut the primer on float rounding error ('accumulate rounding error') and lead directly with the probes and boundary values to watch.

Consider moving the detailed pattern definitions in Step 6 (cache-before-commit, upsert races) to references/concurrency.md alongside the tooling, keeping only the pattern names and the one-line hunting cue inline.

DimensionReasoningScore

Conciseness

The bulk is non-obvious domain content (invariant families, per-class false-positive table, the durable-state evidence bar), but several passages re-explain concepts Claude already knows — e.g. 'concurrent writers each start from the same read and the last write wins' (lost update), 'The default isolation level permits non-repeatable reads and write skew,' and float rounding-error basics. This matches anchor 4 (minor over-explanation that could be trimmed) rather than 5 (every token earns its place).

4 / 5

Actionability

Guidance is concrete and executable throughout: 'order quantity `-1`', 'apply a discount larger than the subtotal to drive the total below zero', 'Submit two different operations under one key; submit one key across two accounts', 'Tamper with `approver_id` / `reviewer_id`', plus a precise evidence bar (1 denied, N concurrent succeed, durable state read back) and worked tooling deferred to references/concurrency.md. Per the rubric's instruction-skill note, absence of inline code is not penalized when the guidance is this actionable — matching anchor 5.

5 / 5

Workflow Clarity

The workflow is clearly sequenced (Authorization gate → model invariants → matrix → state-machine abuse → numeric → stale/saga → concurrency → validation → output) with explicit validation checkpoints: the authorization gate ('If any of these is missing, stop and ask'), the per-class confirmed/false-positive table, and the needs_validation + validation_plan feedback loop. State-mutating/destructive operations are well covered by validation, so no cap applies — anchor 5's checklist-and-feedback-loop pattern is met.

5 / 5

Progressive Disclosure

Core methodology is inline while tooling, verification vocabulary, severity calibration, and output format are split into clearly signaled one-level-deep references — [references/concurrency.md], [references/verification.md], [references/severity-calibration.md], [references/findings-format.md] — all present in the bundle (93–291 lines), substantive, and free of nested indirection. This matches the anchor-5 well-signaled one-level-deep structure.

5 / 5

Total

19

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exemplary description: concrete capabilities with parenthetical specifics for each, an explicit and comprehensive trigger list, and a well-defined niche. Third-person, dense but not padded — every clause carries information.

DimensionReasoningScore

Specificity

The description lists multiple concrete actions — 'Model invariants (conservation of value, uniqueness, monotonicity, exclusivity)', 'build an Actor x Action x Resource matrix', 'abuse state machines (skip/reorder/replay steps, limit-slicing)', 'find numeric bugs (float-vs-decimal rounding, cross-currency refund arbitrage, negative amounts)' — with comprehensive coverage of the domain, matching the anchor-5 example rather than the minor-gaps anchor 4.

5 / 5

Completeness

It explicitly answers both questions: a clear 'what' (test an authorized web application for business-logic flaws and race conditions, with the capability list) and an explicit 'when' with concrete trigger phrases ('Use when the user mentions...'), structurally identical to the anchor-5 example. Not 4, because the when-clause is fully explicit rather than improvable.

5 / 5

Trigger Term Quality

The 'Use when' clause enumerates 13 natural trigger phrases users would actually say — 'business logic testing,' 'race condition,' 'double spend,' 'TOCTOU,' 'coupon reuse,' 'workflow bypass,' 'limit bypass,' 'negative amount,' 'refund arbitrage,' 'parallel request attack,' 'logic flaw' — covering both formal and colloquial synonyms, which meets the comprehensive-coverage anchor.

5 / 5

Distinctiveness Conflict Risk

'Test an authorized web application for business-logic flaws and race conditions — the classes scanners cannot find' carves out a clear niche with distinct triggers (dynamic/concurrency proof, not source audit or generic pentest), giving minimal conflict risk. Not 4: the dynamic-testing framing and specialized trigger vocabulary distinguish it from closely related skills.

5 / 5

Total

20

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

allowed_tools_field

'allowed-tools' contains unusual tool name(s)

Warning

Total

15

/

16

Passed

Repository

briiirussell/cybersecurity-skills

Path

skills/business-logic-testing/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.