[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M74FN43WNXF07KC6F15HDCDG":3,"skill-same:01M74FN43WNXF07KC6F15HDCDG":85},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":18,"linkOnly":19,"markdownContent":20,"markdownBody":21,"frontMatter":22,"refName":28,"commitSha":29,"skillDirectory":30,"forksCount":31,"repositoryHtmlUrl":32,"repositoryHomepageUrl":33,"ownerHtmlUrl":34,"ownerBlogUrl":35,"ownerDescription":36,"updatedAt":37,"install":38,"resources":51},"01M74FN43WNXF07KC6F15HDCDG","business-logic-abuse-review",null,"Derives abuse cases from module docs and checks them against tests and runtime evidence. Use when docs describe stateful workflows, approvals, payments, exports, retries, invites or any action abusable without breaking auth.","Eliyce\u002Fpaqad-ai","Eliyce","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F173689792?v=4","01M74F7NHRXY2FW9KM93WHKHST","01M74F7NJDEWZ2XM9CQV70T3JK",8,"MIT","https:\u002F\u002Fgithub.com\u002FEliyce\u002Fpaqad-ai\u002Fblob\u002Fmain\u002Fruntime\u002Fcapabilities\u002Fsecurity\u002Fskills\u002Fbusiness-logic-abuse-review\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: business-logic-abuse-review\ndescription: 'Derives abuse cases from module docs and checks them against tests and runtime evidence. Use when docs describe stateful workflows, approvals, payments, exports, retries, invites or any action abusable without breaking auth.'\nmetadata:\n  model_tier: reasoning\n  cacheable: 'false'\n  output_format: markdown\n  paqad-meta: skill.meta.yaml\n---\n\n## What It Does\n\nTurns business workflow descriptions into concrete abuse hypotheses so pentest reports can cover replay, bypass, approval skipping, and invalid transitions with project context.\n\n## Use This When\n\nWhen module docs describe stateful workflows, approvals, payments, exports, retries, invites, or any action that can be abused without breaking auth.\n\n## Inputs\n\n- Read the workflow and state-related module docs first.\n- Read `references\u002Fabuse-cases.md` before selecting hypotheses.\n- Read tests and runtime artifacts that could confirm or refute those hypotheses.\n\n## Procedure\n\n1. Run `scripts\u002Ffind-workflow-docs.sh` to enumerate candidate workflow\u002Fstate docs.\n2. Extract state changes, approvals, and high-value actions from those docs.\n3. For each, pick an abuse-case tag from `assets\u002Fabuse-case-categories.txt` (replay, double-submit, invalid-transition, bypass-approval, race, rollback-skip, overspend).\n4. Confirm whether tests or runtime evidence cover that abuse path; record the exact missing proof.\n5. Format per `assets\u002Foutput.template.md` and validate with `scripts\u002Flint-findings.sh`.\n\n## Output Contract\n\n- Match `assets\u002Foutput.template.md`: `## Findings`, `### {{module}}: {{abuse-case-tag}}`, with `Module:`, `Step:`, `Abuse case:`, `Missing proof:`, `Reproduction:` segments.\n- Output must pass `scripts\u002Flint-findings.sh` (exit 0).\n- Reproduction steps must be concrete enough for a manual retest.\n\n## Escalate \u002F Stop Conditions\n\n- Ask when the workflow is clearly high-value but the module docs do not describe its state transitions.\n- Warn when the docs suggest irreversible or financial actions without matching abuse-focused test evidence.\n- Do not present a generic “business logic risk” without naming the exact abuse case.\n\n## Resources\n\n- `references\u002Fabuse-cases.md`\n- `scripts\u002Ffind-workflow-docs.sh`\n- `scripts\u002Flint-findings.sh`\n- `assets\u002Foutput.template.md`\n- `assets\u002Fabuse-case-categories.txt`\n- `agents\u002Fopenai.yaml`\n","## What It Does\n\nTurns business workflow descriptions into concrete abuse hypotheses so pentest reports can cover replay, bypass, approval skipping, and invalid transitions with project context.\n\n## Use This When\n\nWhen module docs describe stateful workflows, approvals, payments, exports, retries, invites, or any action that can be abused without breaking auth.\n\n## Inputs\n\n- Read the workflow and state-related module docs first.\n- Read `references\u002Fabuse-cases.md` before selecting hypotheses.\n- Read tests and runtime artifacts that could confirm or refute those hypotheses.\n\n## Procedure\n\n1. Run `scripts\u002Ffind-workflow-docs.sh` to enumerate candidate workflow\u002Fstate docs.\n2. Extract state changes, approvals, and high-value actions from those docs.\n3. For each, pick an abuse-case tag from `assets\u002Fabuse-case-categories.txt` (replay, double-submit, invalid-transition, bypass-approval, race, rollback-skip, overspend).\n4. Confirm whether tests or runtime evidence cover that abuse path; record the exact missing proof.\n5. Format per `assets\u002Foutput.template.md` and validate with `scripts\u002Flint-findings.sh`.\n\n## Output Contract\n\n- Match `assets\u002Foutput.template.md`: `## Findings`, `### {{module}}: {{abuse-case-tag}}`, with `Module:`, `Step:`, `Abuse case:`, `Missing proof:`, `Reproduction:` segments.\n- Output must pass `scripts\u002Flint-findings.sh` (exit 0).\n- Reproduction steps must be concrete enough for a manual retest.\n\n## Escalate \u002F Stop Conditions\n\n- Ask when the workflow is clearly high-value but the module docs do not describe its state transitions.\n- Warn when the docs suggest irreversible or financial actions without matching abuse-focused test evidence.\n- Do not present a generic “business logic risk” without naming the exact abuse case.\n\n## Resources\n\n- `references\u002Fabuse-cases.md`\n- `scripts\u002Ffind-workflow-docs.sh`\n- `scripts\u002Flint-findings.sh`\n- `assets\u002Foutput.template.md`\n- `assets\u002Fabuse-case-categories.txt`\n- `agents\u002Fopenai.yaml`\n",{"name":5,"metadata":23,"description":7},{"cacheable":24,"model_tier":25,"paqad-meta":26,"output_format":27},"false","reasoning","skill.meta.yaml","markdown","main","793418e848ae0410573905284b68adcab385230e","runtime\u002Fcapabilities\u002Fsecurity\u002Fskills\u002Fbusiness-logic-abuse-review",0,"https:\u002F\u002Fgithub.com\u002FEliyce\u002Fpaqad-ai","https:\u002F\u002Fpaqad.ai","https:\u002F\u002Fgithub.com\u002FEliyce","https:\u002F\u002Feliyce.com\u002F","AI delivery you can review. Dutch software company building software and AI agents. Makers of Paqad, the open-source AI delivery framework.","2026-11-13 04:41:45",{"source":8,"skillName":5,"commands":39,"prompt":49,"zipAvailable":50},[40,43,46],{"tool":41,"command":42},"npx","npx skills add Eliyce\u002Fpaqad-ai --skill business-logic-abuse-review",{"tool":44,"command":45},"bunx","bunx skills add Eliyce\u002Fpaqad-ai --skill business-logic-abuse-review",{"tool":47,"command":48},"pnpm","pnpm dlx skills add Eliyce\u002Fpaqad-ai --skill business-logic-abuse-review","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FEliyce\u002Fpaqad-ai\u002Fblob\u002Fmain\u002Fruntime\u002Fcapabilities\u002Fsecurity\u002Fskills\u002Fbusiness-logic-abuse-review\u002FSKILL.md",true,[52,58,64,68,72,78,82],{"path":53,"resourceType":54,"resourceTypeDesc":55,"sizeBytes":56,"sourceHtmlUrl":57},"agents\u002Fopenai.yaml","REFERENCE","参考文档",136,"https:\u002F\u002Fgithub.com\u002FEliyce\u002Fpaqad-ai\u002Fblob\u002Fmain\u002Fruntime\u002Fcapabilities\u002Fsecurity\u002Fskills\u002Fbusiness-logic-abuse-review\u002Fagents\u002Fopenai.yaml",{"path":59,"resourceType":60,"resourceTypeDesc":61,"sizeBytes":62,"sourceHtmlUrl":63},"assets\u002Fabuse-case-categories.txt","ASSET","资产文件",488,"https:\u002F\u002Fgithub.com\u002FEliyce\u002Fpaqad-ai\u002Fblob\u002Fmain\u002Fruntime\u002Fcapabilities\u002Fsecurity\u002Fskills\u002Fbusiness-logic-abuse-review\u002Fassets\u002Fabuse-case-categories.txt",{"path":65,"resourceType":60,"resourceTypeDesc":61,"sizeBytes":66,"sourceHtmlUrl":67},"assets\u002Foutput.template.md",477,"https:\u002F\u002Fgithub.com\u002FEliyce\u002Fpaqad-ai\u002Fblob\u002Fmain\u002Fruntime\u002Fcapabilities\u002Fsecurity\u002Fskills\u002Fbusiness-logic-abuse-review\u002Fassets\u002Foutput.template.md",{"path":69,"resourceType":54,"resourceTypeDesc":55,"sizeBytes":70,"sourceHtmlUrl":71},"references\u002Fabuse-cases.md",2857,"https:\u002F\u002Fgithub.com\u002FEliyce\u002Fpaqad-ai\u002Fblob\u002Fmain\u002Fruntime\u002Fcapabilities\u002Fsecurity\u002Fskills\u002Fbusiness-logic-abuse-review\u002Freferences\u002Fabuse-cases.md",{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"scripts\u002Ffind-workflow-docs.sh","SCRIPT","脚本",874,"https:\u002F\u002Fgithub.com\u002FEliyce\u002Fpaqad-ai\u002Fblob\u002Fmain\u002Fruntime\u002Fcapabilities\u002Fsecurity\u002Fskills\u002Fbusiness-logic-abuse-review\u002Fscripts\u002Ffind-workflow-docs.sh",{"path":79,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":80,"sourceHtmlUrl":81},"scripts\u002Flint-findings.sh",1241,"https:\u002F\u002Fgithub.com\u002FEliyce\u002Fpaqad-ai\u002Fblob\u002Fmain\u002Fruntime\u002Fcapabilities\u002Fsecurity\u002Fskills\u002Fbusiness-logic-abuse-review\u002Fscripts\u002Flint-findings.sh",{"path":26,"resourceType":54,"resourceTypeDesc":55,"sizeBytes":83,"sourceHtmlUrl":84},395,"https:\u002F\u002Fgithub.com\u002FEliyce\u002Fpaqad-ai\u002Fblob\u002Fmain\u002Fruntime\u002Fcapabilities\u002Fsecurity\u002Fskills\u002Fbusiness-logic-abuse-review\u002Fskill.meta.yaml",[86,93,100,105,112,119],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":18},"01M74FSCKQP6TACC8X8AZ19F4V","sample-skill","Sample bundled skill fixture","https:\u002F\u002Fgithub.com\u002FEliyce\u002Fpaqad-ai\u002Fblob\u002Fmain\u002Ftests\u002Funit\u002Fadapters\u002Ffixtures\u002Fsample-skill\u002FSKILL.md",[],[],{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":18},"01M74FSAQ6C28V4G3322XGMARB","processing-invoices","Turns a supplier invoice into one ledger line. Use when a supplier invoice arrives and needs booking.","https:\u002F\u002Fgithub.com\u002FEliyce\u002Fpaqad-ai\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fauthoring\u002Fnpm-project\u002Fskill\u002FSKILL.md",[],[],{"skillNo":101,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":18},"01M74FS914YQKWQNHC58MEG1N8","https:\u002F\u002Fgithub.com\u002FEliyce\u002Fpaqad-ai\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fauthoring\u002Flaravel-project\u002Fskill\u002FSKILL.md",[],[],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":18},"01M74FS356J9QP10A362QRVCPZ","understand-idea","Chat and Claude Code: Step 1 of the discover journey: clarifies the goal, who benefits, success and constraints into the idea block. Use when the journey directs it to step 1, not directly.","https:\u002F\u002Fgithub.com\u002FEliyce\u002Fpaqad-ai\u002Fblob\u002Fmain\u002Fruntime\u002Fclaude-plugin\u002Fskills\u002Funderstand-idea\u002FSKILL.md",[],[],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":18},"01M74FRSWEMB7KNVW0TP8P3JKB","size-work","Chat and Claude Code: Suggest a size for a ticket from comparable finished work, as a labelled suggestion the team still owns. Use it when someone asks \"how big is this?\", \"roughly how much work is ABC-12?\", or wants a backlog item sized. It finds the team's sizing scale at first use, picks two to five of the closest finished tickets with links, and gives a size or range with the drivers behind it and a confidence of low, medium or high, lowered and explained when the area's documents are template text. Every result is labelled a suggested size, never a date or a commitment. It writes nothing into the size field unless the user says \"set it\", and it refuses to overwrite an existing size unless the user asks to replace it. Produces the sizing block of the record.","https:\u002F\u002Fgithub.com\u002FEliyce\u002Fpaqad-ai\u002Fblob\u002Fmain\u002Fruntime\u002Fclaude-plugin\u002Fskills\u002Fsize-work\u002FSKILL.md",[],[],{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":18},"01M74FR9A9VPHW1NFAFYZMXE2H","refine-ticket","Chat and Claude Code: Improve one or more existing tracker tickets without losing the author's intent. Use it when someone wants a ticket read, diagnosed and tidied up (\"this ticket is vague\", \"fix up ABC-12\", \"split this, it's too big\"). It reads each ticket in full and snapshots it with its last-updated time, says what is wrong with evidence, and proposes a field-by-field before and after change set limited to summary, description, labels, parent, links and new child tickets on a split. It writes nothing until an explicit \"apply it\" bound to that exact change set, re-checks the ticket for conflicting edits just before writing, never replaces rich descriptions with plain text, never deletes or closes a ticket, and reads each ticket back after applying. Produces the existing and changes blocks of the record.","https:\u002F\u002Fgithub.com\u002FEliyce\u002Fpaqad-ai\u002Fblob\u002Fmain\u002Fruntime\u002Fclaude-plugin\u002Fskills\u002Frefine-ticket\u002FSKILL.md",[],[]]