offensive-business-logic

测试 Web/ 移动 /API 业务逻辑漏洞 覆盖流程绕过 状态机违规 多步骤滥用等场景

Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows, role/tenant boundary violations, time-of-check vs use, anti-automation defeat, fraud-detection evasion, and subscription/quota abuse. Use when scoping an application after surface-level OWASP Top 10 has been covered, or when the asset is a transactional/marketplace/fintech/e-commerce/SaaS app where logic flaws produce direct financial impact.

请帮我安装这个 Agent Skill：https://github.com/SnailSploit/Claude-Red/tree/main/Skills/web/offensive-business-logic

1. 先读取该目录下的 SKILL.md 和其他文件，检查是否有可疑内容（执行未知脚本、读取密钥、向外发送数据等），用中文告诉我它会做什么、需要哪些权限；
2. 等我确认后，再把整个目录安装到 ~/.claude/skills/offensive-business-logic/（如果你不是 Claude Code，安装到你自己约定的 skills 目录）；
3. 安装后告诉我怎么触发它。

git clone --depth 1 --filter=blob:none --sparse https://github.com/SnailSploit/Claude-Red.git /tmp/offensive-business-logic-src
cd /tmp/offensive-business-logic-src && git sparse-checkout set "Skills/web/offensive-business-logic"
mkdir -p ~/.claude/skills && cp -r "Skills/web/offensive-business-logic" ~/.claude/skills/offensive-business-logic

Skill 可以让智能体执行脚本。安装第三方 Skill 前务必看一遍内容，详见「安全」一课。