Strix•业务逻辑漏洞
Strix 业务逻辑漏洞测试手册,覆盖流程绕过、状态操控与领域约束破坏;触发名:strix-business-logic
Profile →npx skills add asdfgh1445/ctf-super-hub --skill strix-business-logic --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Business Logic Flaws Business logic flaws exploit intended functionality to violate domain invariants: move money without paying, exceed limits, retain privileges, or bypass reviews. They require a model of the business, not just payloads. ## Attack Surface - Financial logic: pricing, discounts, payments, refunds, credits, chargebacks - Account lifecycle: signup, upgrade/downgrade, trial, suspension, deletion - Authorization-by-logic: feature gates, role transitions, approval workflows - Quotas/limits: rate/usage limits, inventory, entitlements, seat licensing - Multi-tenant isolation: cross-organization data or action bleed - Event-driven flows: jobs, webhooks, sagas, compensations, idempotency ## High-Value Targets - Pricing/cart: price locks, quote to order, tax/shipping computation - Discount engines: stacking, mutual exclusivity, scope (cart vs item), once-per-user enforcement - Payments: auth/capture/void/refund sequences, partials, split tenders, chargebacks, idempotency keys - Credits/gift cards/vouchers: issuance, redemption, reversal, expiry, transferability - Subscriptions: proration, upgrade/downgrade, trial extension, seat counts, meter reporting - Refunds/returns/RM
- Attack Surface
- High-Value Targets
- Reconnaissance
- Workflow Mapping
- Input Surface
- State and Time Axes
- Key Vulnerabilities
- State Machine Abuse
- Concurrency and Idempotency
- Numeric and Currency
- Quotas, Limits, and Inventory
- Refunds and Chargebacks
- Feature Gates and Roles
- Advanced Techniques
What does the Strix•业务逻辑漏洞 skill do?
Strix 业务逻辑漏洞测试手册,覆盖流程绕过、状态操控与领域约束破坏;触发名:strix-business-logic
How do I install it?
Run `npx skills add asdfgh1445/ctf-super-hub --skill strix-business-logic --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From asdfgh1445/ctf-super-hub, a repository with 718 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.