Name: sast-businesslogic
Rating: 70.39999999999999 (1 reviews)
Author: utkusen

sast-businesslogic

Detect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack scenarios), batched verify (check exploitable gaps in parallel subagents, 3 scenarios each), and merge (consolidate batch results). Covers price manipulation, workflow bypass, limit violations, race conditions, reward abuse, etc. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/businesslogic-results.md. Use when asked to find business logic, logic flaws, or abuse-of-function bugs.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

The canonical home for this skill is sast-businesslogic in utkusen/sast-skills

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with a clear, validated three-phase workflow, but it is verbose for its context budget and keeps large reference-style material (attack taxonomy, output templates) inline rather than splitting it into bundle files.

Suggestions

Move the 12 attack-category definitions and the verbatim Phase 1/2/3 output templates into a references/ file (e.g. references/categories.md and references/output-formats.md), keeping SKILL.md a lean overview.

Trim the 'What are Business Logic Vulnerabilities' concept explanation and TOCTOU definition to a one-line pointer; assume Claude already knows these concepts.

Shorten the duplicated 'what business logic flaws are NOT' lists that appear in both the overview and the Phase 2 prompt to a single shared reference.

Dimension	Reasoning	Score
Conciseness	The ~360-line body is mostly efficient operational guidance, but it includes concept explanation Claude already knows (defining business logic vulns, TOCTOU) and lengthy verbatim output templates that pad the context, so it falls at the 'mostly efficient but could be tightened' anchor.	3 / 5
Actionability	Provides fully executable, copy-paste-ready guidance: concrete subagent prompts, a worked batching example (8 scenarios -> 3 batches), exact filenames, per-category verification checks, and complete field-by-field output-format templates.	5 / 5
Workflow Clarity	Three explicitly sequenced phases with ordering constraints, a parallel batching procedure, and validation checkpoints (exploitability classification, 'when in doubt classify as Needs Manual Review', intermediate-file cleanup), with feedback guidance for a batch operation.	5 / 5
Progressive Disclosure	No bundle files exist, so all content (12 attack categories, full output templates) is inlined in SKILL.md; section headers give structure, but substantial content that could live in a separate reference is inline, matching the 'some structure, content that should be separate is inline' anchor.	3 / 5
	Total	16 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it specifies concrete actions, an explicit 'Use when' trigger, prerequisites, and outputs, all in a distinct niche. Its only minor gap is slightly limited synonym coverage in the trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions (threat modeling, batched verify with 3 scenarios each, merge) plus a comprehensive coverage list ('price manipulation, workflow bypass, limit violations, race conditions, reward abuse, etc.'), matching the comprehensive-coverage anchor.	5 / 5
Completeness	Explicitly answers both 'what' (three-phase detection approach with coverage categories, prerequisite and output file) and 'when' ('Use when asked to find business logic, logic flaws, or abuse-of-function bugs') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural phrases users would say ('find business logic, logic flaws, or abuse-of-function bugs') with good keyword coverage, but is missing some common synonyms (e.g. 'business rules'), so it sits between the good and comprehensive anchors.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (business logic vulnerabilities) distinct from injection/auth skills, with specific triggers and a named output artifact, giving minimal conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: utkusen/sast-skills
Path: sast-files/.claude/skills/sast-businesslogic/SKILL.md
Commit: db52227

Reviewed: 15 minutes ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.