Skills for Real Engineers. Straight from my .agents directory.
39 skills
hunt-business-logic
Agent skill from
Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), negative-quantity-in-cart price tampering (Upserve, Eternal/Zomato), decimal/fraction price-field overflow (Shipt), client-side checkout amount trust on PayPal redirect (WordPress.org), price-per-unit mass-assignment (Krisp), and archived-price swap / cart-TOCTOU (Stripe). Use when hunting business logic — heavy emphasis on financial-impact-demonstrated cases.
How to install hunt-business-logic
install hunt-business-logic
# install the Claude-BugHunter pack with the skills CLI
npx skills add elementalsouls/Claude-BugHunter# or add only this skill to Claude Code: copy the folder
skills/hunt-business-logic/
# into
~/.claude/skills/hunt-business-logic/ (all projects)
.claude/skills/hunt-business-logic/ (one project)
1## Crown Jewel Targets23Business logic vulnerabilities pay highest in platforms where financial transactions, identity verification, and access controls intersect with real-world consequences. The richest targets are:45- **E-commerce & payment platforms** (Valve/Steam, Shopify) — payment flow manipulation, free goods, price tampering6- **Marketplace & gig economy apps** (Airbnb, Uber) — identity/verification bypass enabling fraud or unsafe interactions7- **SaaS with tiered access** (Mozilla Monitor) — bypassing verification to unlock monitoring features without entitlement8- **High-traffic consumer apps** (Snapchat, Yelp) — rate-limit bypass enabling spam, enumeration, or abuse at scale910Asset types that pay: checkout flows, subscription endpoints, callback/verification systems, webhook handlers, employee/internal portals exposed to the internet, and any endpoint that trusts client-supplied data to make authorization decisions.1112---1314## Attack Surface Signals1516**URL patterns to watch:**17- `/checkout`, `/order`, `/subscribe`, `/payment`, `/verify`, `/confirm`, `/callback`18- `/internal`, `/employee`, `/summit`, `/staff`, `/admin` — internal pages accidentally public19- `/api/v*/payment`, `/api/v*/notify`, `/webhook` — payment provider callbacks20- Endpoints accepting `X-Forwarded-For`, `X-Real-IP`, `CF-Connecting-IP` headers2122**Response/header signals:**23- `Set-Cookie` with unvalidated session state tied to cart or order data24…
Excerpt shown under the repository's MIT license.
More skills in Claude-BugHunter
Keep exploring
Similar skill repositories
An agentic skills framework & software development methodology that works.
15 skills
Public repository for Agent Skills
20 skills
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
CCCU6 skills
Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
CCCXGHGM+135 skills
Production-grade engineering skills for AI coding agents.
CCCXCU25 skills