hellodqy/mastermind-bug-bounty/business-logic
Claude Code and agent skill by hellodqy/mastermind-bug-bounty
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Test multi-step business workflows when server-side state, value, ownership, or transition invariants may be bypassed without a conventional injection flaw.
Install
npx vskill@latest install hellodqy/mastermind-bug-bounty/business-logicSKILL.md
Business Logic
Goal
恢复业务状态机与价值守恒条件，判断步骤跳过、重放、参数信任或跨渠道差异能否突破服务端约束。
Tools / Inputs
- 正常业务流、状态字段、金额/数量/权益参数、接口顺序、测试订单与账号
- 资源索引：
references/INDEX.md；候选资源：business-logic-testing.md、race-condition-testing.md
Constraints
- 仅使用测试资产，不制造真实资损、库存或第三方影响。
- 先记录正常状态转换，再改变一个变量。
- 客户端显示异常不是结论，必须验证服务端最终状态。
- 可疑优惠或余额结果不得提现、转移或消费真实资源。
- 并发假设交给 race-condition，身份假设交给 IDOR/account-takeover。
Chain Questions
- 哪些状态、价格、数量、角色或顺序应该由服务端保持不变量？
- 是否能跳步、逆序、重放或从另一渠道继续流程？
- 中间票据是否绑定用户、商品、金额、动作和有效期？
- 异常状态能否转化为持久权益、权限或跨用户影响？
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/business_logic/SKILL.md
Popularity
- 7-day trend score
- 5
Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/business-logic)