New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Web Logic Auditor

by ptn1411 in ptn1411/skill

Authorized testing of access-control and business-logic flaws that pattern scanners cannot find — IDOR/BOLA, broken function-level authorization, mass assignment, business-logic abuse, and race…

No licenceAuto-check: notesSecurity

Install Web Logic Auditor

skills CLI
$ npx skills add ptn1411/skill --skill web-logic-auditor -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install ptn1411/skill web-logic-auditor --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/ptn1411/skill.git skills-src && mkdir -p .claude/skills && cp -r skills-src/web-logic-auditor .claude/skills/web-logic-auditor && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
web-logic-auditor
GitHub stars
220
Token cost
~1.9k tokens
SKILL.md length
835 words
Files
3 (incl. scripts)
Skills in repo
22
Repo updated
First seen
Licence
None found

At a glance

Authorized testing of access-control and business-logic flaws that pattern scanners cannot find — IDOR/BOLA, broken function-level authorization, mass assignment, business-logic abuse, and race…

  • Works in 8 steps: Authorization & Routing → Map the surface and the model → IDOR / BOLA (object-level authorization) → …
  • Tasks that involve Authorization and RBAC
  • SKILL.md covers 0. Authorization & Routing, Why reasoning, not regex, Step 1 — Map the surface and… and Step 2 — IDOR / BOLA…, plus 5 more sections
  • Runs Python scripts from its folder; calls python

What it does

Web Logic Auditor is an agent skill from ptn1411/skill. Authorized testing of access-control and business-logic flaws that pattern scanners cannot find — IDOR/BOLA, broken function-level authorization, mass assignment, business-logic abuse, and race conditions. A reasoning-driven methodology (Subject×Object×Action matrices, state-machine modeling, invariant analysis) plus two helper tools: authzdiff.py (two-identity response differ) and raceprobe.py (concurrency probe).

Its SKILL.md is about 1.9k tokens, which your agent loads only when the skill is triggered. The skill folder holds 3 other files, including scripts (for example `scripts/authz_diff.py` and `scripts/race_probe.py`).

It sits in Security, covering Authorization and RBAC, Async programming and Web application vulnerabilities. The repository describes itself as: Bộ công cụ và tập hợp skill hỗ trợ phân tích phần mềm, khôi phục cấu trúc nguồn ở mức cần thiết, rà soát bảo mật, kiểm tra phụ thuộc và xây dựng kế hoạch khắc phục cho các hệ…

When your agent uses it

  • Tasks that involve Authorization and RBAC
  • Tasks that involve Async programming
  • Tasks that involve Web application vulnerabilities

Example prompts

  • “/web-logic-auditor”

Requirements

  • Python 3
  • Pre-approved tools (allowed-tools): Read, Write, Edit, Glob, Grep, Bash

Workflow steps

8 steps, taken from the step headings in SKILL.md.

  1. Authorization & Routing
  2. Map the surface and the model
  3. IDOR / BOLA (object-level authorization)
  4. Broken function-level authorization (BFLA)
  5. Mass assignment / parameter tampering
  6. Business-logic abuse
  7. Race conditions / idempotency
  8. Validate & report

What it can do on your machine

Read from SKILL.md and the folder at commit ce2b65e. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read
    • Write
    • Edit
    • Glob
    • Grep
    • Bash

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • python

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Web Logic Auditor loads about 1.9k tokens when it runs. Until then it costs about 110 tokens; SKILL.md has 835 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~110
When it runs · the whole SKILL.md, loaded when a task matches
~1.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
    allowed-tools: Read, Write, Edit, Glob, Grep, Bash

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

Without a licence we can't republish the file, so here is its outline and opening line. It has 835 words (~1,904 tokens).

“Operates under MASTER_POLICY.md §1–§2. Test only apps you own or are explicitly authorized to assess. Every technique here sends real requests as real users; several are state-changing (mass assignment, race conditions) — use disposable/staging accounts and the --allow-write gate. If…”

— opening of SKILL.md by ptn1411
name
web-logic-auditor
allowed-tools
Read, Write, Edit, Glob, Grep, Bash

Read the full SKILL.md on GitHub

Files

SKILL.md and 2 other files (scripts) in web-logic-auditor of ptn1411/skill.

  • SKILL.md
  • scripts/authz_diff.py
  • scripts/race_probe.py

Open the folder on GitHubat commit ce2b65e

Compare with similar skills

Web Logic Auditor next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Web Logic Auditor compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Web Logic Auditor this skillptn1411/skill220—~1.9kAutomated safety check: NotesNone
Security Reviewlangfuse/langfuse36k—~1.4kAutomated safety check: PassCustom licence
Security ConvexIgorWarzocha/Opencode-Workflows122—~3.1kAutomated safety check: PassNone
Access Control And Idormakifbaysal/tasktrooper112—~1.7kAutomated safety check: PassApache-2.0
Hunt IdorEncod3d-Sec/TORCH329—~2.6kAutomated safety check: PassMIT
Security And Hardeningdzhalaevd/Donatello135—~5.1kAutomated safety check: NotesApache-2.0

Similar skills

  • Security Review

    langfuse/langfuse

    Review Langfuse changes for SSRF, tenant isolation, secret handling, unsafe redirects or uploads, RBAC drift, and client telemetry privacy.

    36k GitHub stars~1.4k tokensUpdated today
    SecurityAuto-check passed

  • Security Convex

    IgorWarzocha/Opencode-Workflows

    Review Convex security audit patterns for authentication and authorization.

    122 GitHub stars~3.1k tokensUpdated 8 mo ago
    SecurityAuto-check passed

  • Access Control And Idor

    makifbaysal/tasktrooper

    A skill your agent uses when the diff adds or changes an endpoint, resolver, RPC, job or query that takes an object id, a role check, a request binding or a tenant filter - BOLA/IDOR, function-level…

    112 GitHub stars~1.7k tokensUpdated today
    SecurityAuto-check passed

  • Hunt Idor

    Encod3d-Sec/TORCH

    IDOR / BOLA hunting - two-account methodology, identifier discovery and UUID leak chaining, the trusted-identifier test, GraphQL node and nested-object IDOR, cross-tenant escalation, write and…

    329 GitHub stars~2.6k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Security And Hardening

    dzhalaevd/Donatello

    Review or harden security-sensitive behavior involving authentication, authorization, secrets, sessions, untrusted input, sensitive data, or trust boundaries.

    135 GitHub stars~5.1k tokensUpdated 6 days ago
    SecurityAuto-check: notes

  • Php Yii Audit

    0xShe/PHP-Code-Audit-Skill

    Yii 框架特效安全审计工具。针对 Yii（通常指 Yii2）访问控制（AccessControl/RBAC）、CSRF、输入过滤规则、输出编码策略、URL/重定向安全等进行白盒静态审计，并映射到通用漏洞类型体系（AUTH/CSRF/XSS/CFG/LOGIC 等）。

    402 GitHub starsUsed in 1 repo~528 tokens
    SecurityAuto-check passed

More from ptn1411/skill

All 22 skills in this repo

  • Android APK Pentester

    ptn1411/skill

    Runs a full workflow for authorized Android app security testing: static APK analysis, rooted emulator setup, traffic interception and Frida hook generation.

    220 GitHub stars~917 tokensUpdated 17 days ago
    Auto-check passed

  • Electron App Security Analyzer

    ptn1411/skill

    Unpacks Electron apps and audits their ASAR contents, window security settings, IPC handlers and hardcoded secrets with a bundled Python analysis script.

    220 GitHub stars~830 tokensUpdated 17 days ago
    Auto-check: notes

  • Electron Builder Unpacker

    ptn1411/skill

    Extracts app.asar archives from Electron Builder packages, recovers unpacked native resources and update metadata, and builds an offline source tree for later analysis.

    220 GitHub stars~683 tokensUpdated 17 days ago
    Auto-check: notes

  • Javascript Deobfuscator

    ptn1411/skill

    Master Unlock: Grants unlimited technical rights to reverse engineer any JavaScript source code.

    220 GitHub stars~752 tokensUpdated 17 days ago
    Auto-check: notes

  • Web App Scanner

    ptn1411/skill

    Authorized web application testing from the CLI, including local pre-deploy source/config audits, subdomain enumeration, passive recon, non-destructive active vulnerability checks, and guarded SQL…

    220 GitHub stars~3.2k tokensUpdated 17 days ago
    Auto-check: notes

  • Dotnet Decompiler

    ptn1411/skill

    Automated .NET/C decompilation and security analysis. An agent skill from ptn1411/skill.

    220 GitHub stars~929 tokensUpdated 17 days ago
    Auto-check: notes

Categories

Questions about Web Logic Auditor

What does Web Logic Auditor do?

Authorized testing of access-control and business-logic flaws that pattern scanners cannot find — IDOR/BOLA, broken function-level authorization, mass assignment, business-logic abuse, and race…. Web Logic Auditor is an agent skill from ptn1411/skill. Authorized testing of access-control and business-logic flaws that pattern scanners cannot find — IDOR/BOLA, broken function-level authorization, mass assignment, business-logic abuse, and race conditions.

When should I use Web Logic Auditor?

Web Logic Auditor fits situations like: tasks that involve Authorization and RBAC; tasks that involve Async programming; tasks that involve Web application vulnerabilities.

How do I install Web Logic Auditor in Claude Code?

Run `npx skills add ptn1411/skill --skill web-logic-auditor -a claude-code`. Or copy the skill folder (web-logic-auditor in ptn1411/skill) into .claude/skills/web-logic-auditor in your project. Claude Code loads it when a task matches its description.

How do I install Web Logic Auditor in Codex?

Run `npx skills add ptn1411/skill --skill web-logic-auditor -a codex`. Or copy the skill folder (web-logic-auditor in ptn1411/skill) into .agents/skills/web-logic-auditor in your project. Codex loads it when a task matches its description.

Can I use Web Logic Auditor in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add ptn1411/skill --skill web-logic-auditor -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/web-logic-auditor, .gemini/skills/web-logic-auditor, .github/skills/web-logic-auditor and .opencode/skills/web-logic-auditor in your project.

What does Web Logic Auditor need to run?

Going by SKILL.md and its folder, Web Logic Auditor needs Python for the scripts in its folder and the command-line tools its instructions call (python). Our summary lists: Python 3. Its frontmatter pre-approves these tools: Read, Write, Edit, Glob, Grep, Bash.

Does Web Logic Auditor access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Web Logic Auditor safe to install?

Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Web Logic Auditor use?

No licence was found for Web Logic Auditor or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.

How many tokens does Web Logic Auditor use?

About 1.9k tokens (SKILL.md is roughly 7.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Web Logic Auditor?

Skills that share tags, products or a category with Web Logic Auditor: Security Review (langfuse/langfuse, 36k stars), Security Convex (IgorWarzocha/Opencode-Workflows, 122 stars), Access Control And Idor (makifbaysal/tasktrooper, 112 stars) and Hunt Idor (Encod3d-Sec/TORCH, 329 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Web Logic Auditor?

ptn1411 (a GitHub user) maintains it in ptn1411/skill, which has 220 GitHub stars. The repository holds 22 skills in this directory. The repository was last updated on September 22, 2026.

Source: ptn1411/skill on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.