web-app-logic
Web application logic testing - business logic flaws, race conditions, access control, cache poisoning/deception, and information disclosure.
- Installs
- 203
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/transilienceai/communitytools --skill web-app-logic- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads web-app-logic automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Web Application Logic
Test for logic flaws and application-specific vulnerabilities that automated scanners miss.
Techniques
| Type | Key Vectors |
|---|---|
| Business Logic | Workflow bypass, price manipulation, feature abuse |
| Race Conditions | TOCTOU, limit bypass, double-spend, parallel requests |
| Access Control | IDOR, horizontal/vertical privilege escalation, forced browsing |
| Cache Poisoning | Unkeyed headers/parameters, fat GET, response splitting |
| Cache Deception | Path confusion, static extension tricks, normalization |
| Info Disclosure | Error messages, debug endpoints, source code, metadata |
Workflow
- Map application workflows and business rules
- Identify state-dependent operations and trust boundaries
- Test logic assumptions with edge cases and race conditions
- Verify access control across user roles
- Document impact with PoC demonstrations
Reference
reference/business-logic*.md- Business logic testing techniquesreference/race-conditions*.md- Race condition exploitationreference/access-control*.md- Access control bypass methodsreference/web-cache-poisoning*.md- Cache poisoning techniquesreference/web-cache-deception*.md- Cache deception attacksreference/information-disclosure*.md- Information disclosure testing
FAQ
What does the web-app-logic skill do?
Web application logic testing - business logic flaws, race conditions, access control, cache poisoning/deception, and information disclosure.
How do I install web-app-logic?
Run npx skills add https://github.com/transilienceai/communitytools --skill web-app-logic in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/web-app-logic/ (personal) or .claude/skills/web-app-logic/ (project).
Which AI agents can use web-app-logic?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is web-app-logic safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains web-app-logic?
It is published by transilienceai in transilienceai/communitytools. It has 203 recorded installs.
More from transilienceai/communitytools
attack-path-stitcher
transilienceai/communitytools
Stitches confirmed single-asset findings into multi-hop attack paths across the organization. Builds a graph where nodes are assets and edges are confirmed exploit hops citing the findings that enable them.
blockchain-security
transilienceai/communitytools
Smart contract security testing and blockchain CTF exploitation. Covers Solidity vulnerability analysis, EVM storage manipulation, delegatecall attacks, CREATE/CREATE2 address prediction, and common DeFi exploit patterns. Use when analyzing Solidity contracts, solving blockchain challenges, or testing smart contract security.
hackerone
transilienceai/communitytools
HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents per asset, validates PoCs, and generates platform-ready submission reports.
osint
transilienceai/communitytools
Open-source intelligence gathering - company repository enumeration, secret scanning, git history analysis, employee footprint, and code exposure discovery.
reconnaissance
transilienceai/communitytools
Open the skill to read its SKILL.md instructions.
cve-poc-generator
transilienceai/communitytools
Open the skill to read its SKILL.md instructions.
Popular testing & qa skills
tdd
mattpocock/skills
Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions "red-green-refactor", or wants integration tests.
grilling
mattpocock/skills
Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.
migrate-to-shoehorn
mattpocock/skills
Migrate test files from as type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace as in tests, or needs partial test data.
run-train
lllllllama/rigorpilot-skills
Rigor Train skill for deep learning research repositories. Use when a documented or selected training command should be run conservatively for startup verification, short-run verification, full kickoff, or resume, with command, config, seed, log, checkpoint, status, and metric evidence written to standardized trainoutputs/. Do not use for environment setup, exploratory sweeps, speculative idea implementation, or end-to-end orchestration.
test-driven-development
obra/superpowers
Use when implementing any feature or bugfix, before writing implementation code
finishing-a-development-branch
obra/superpowers
Use when implementation is complete, all tests pass, and you need to decide how to integrate the work