Agent skill

Business Logic Race

当目标存在支付/下单/退款/提现/转账/优惠券/积分/红包/会员/订阅/审批/库存/抽奖等业务功能，或发现状态可跳变、金额参数可控、并发可重放时调用。负责业务状态机建模、金额篡改、订单状态跳变、竞态条件与重放攻击深度挖掘。

MITAuto-check passed

Install Business Logic Race

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill business-logic-race -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS business-logic-race --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/business-logic-race .claude/skills/business-logic-race && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "business-logic-race" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/business-logic-race into .claude/skills/business-logic-race/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "business-logic-race", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/business-logic-race

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill business-logic-race -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS business-logic-race --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/business-logic-race .agents/skills/business-logic-race && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "business-logic-race" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/business-logic-race into .agents/skills/business-logic-race/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "business-logic-race", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill business-logic-race -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS business-logic-race --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/business-logic-race .cursor/skills/business-logic-race && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "business-logic-race" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/business-logic-race into .cursor/skills/business-logic-race/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "business-logic-race", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/zhaji2333/CkSKILLS.git --path .agents/skills/business-logic-race

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill business-logic-race -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS business-logic-race --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/business-logic-race .gemini/skills/business-logic-race && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "business-logic-race" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/business-logic-race into .gemini/skills/business-logic-race/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "business-logic-race", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS business-logic-race

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill business-logic-race -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/business-logic-race .github/skills/business-logic-race && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "business-logic-race" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/business-logic-race into .github/skills/business-logic-race/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "business-logic-race", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill business-logic-race -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS business-logic-race --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/business-logic-race .opencode/skills/business-logic-race && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "business-logic-race" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/business-logic-race into .opencode/skills/business-logic-race/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "business-logic-race", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: business-logic-race
GitHub stars: 115
Token cost: ~466 tokens
SKILL.md length: 93 words
Files: 1
Skills in repo: 15
Repo updated: Sep 15, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Works in 5 steps: 这个功能的完整状态机是什么？（所有状态+所有转换条件） → 每个状态转换谁有权执行？（角色矩阵） → 哪些转换不应该被允许？（非法路径） → …
SKILL.md covers 何时调用（触发条件）, 一、业务逻辑建模（先理解再测试）, 二、支付/资金类场景表（全景） and 三、业务逻辑漏洞攻击套路, plus 3 more sections
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Business Logic Race is an agent skill from zhaji2333/CkSKILLS. 当目标存在支付/下单/退款/提现/转账/优惠券/积分/红包/会员/订阅/审批/库存/抽奖等业务功能，或发现状态可跳变、金额参数可控、并发可重放时调用。负责业务状态机建模、金额篡改、订单状态跳变、竞态条件与重放攻击深度挖掘。

Its SKILL.md is about 470 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

The repository describes itself as: 基于 Claude Code / Codex 的 SRC 漏洞挖掘 Agent 技能体系 —— 将顶尖安全研究员的方法论沉淀为可调度、可复用的 Skill 知识资产。 The licence is MIT.

Example prompts

“/business-logic-race”

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

这个功能的完整状态机是什么？（所有状态+所有转换条件）
每个状态转换谁有权执行？（角色矩阵）
哪些转换不应该被允许？（非法路径）
数据在各环节的一致性校验在哪里做的？（前端/后端/数据库）
并发场景下会不会出问题？（竞态条件）

What it can do on your machine

Read from SKILL.md and the folder at commit 482fe78. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Business Logic Race loads about 466 tokens when it runs. Until then it costs about 33 tokens; SKILL.md has 93 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~33
When it runs · the whole SKILL.md, loaded when a task matches: ~466

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from zhaji2333/CkSKILLS at commit 482fe78, republished under its MIT licence (© zhaji2333). 93 words, ~466 tokens.

Download SKILL.mdSave it as .claude/skills/business-logic-race/SKILL.md (or your agent's skills folder).

name: business-logic-race
description: 当目标存在支付/下单/退款/提现/转账/优惠券/积分/红包/会员/订阅/审批/库存/抽奖等业务功能，或发现状态可跳变、金额参数可控、并发可重放时调用。负责业务状态机建模、金额篡改、订单状态跳变、竞态条件与重放攻击深度挖掘。

business-logic-race — 业务逻辑与并发竞态专项深度挖掘

何时调用（触发条件）

支付流程：下单→支付→回调→发货→退款→提现
资金相关：金额、数量、折扣、优惠券、积分、余额、红包
状态流转：订单状态、审批状态、权益状态可被篡改/跳过
并发场景：库存扣减、优惠券领取、提现、转账、兑换
业务复杂：状态机不清晰、一致性校验位置不明

一、业务逻辑建模（先理解再测试）

原则：不理解业务就不可能发现业务逻辑漏洞。

测试任何功能前，必须先回答：

这个功能的完整状态机是什么？（所有状态+所有转换条件）
每个状态转换谁有权执行？（角色矩阵）
哪些转换不应该被允许？（非法路径）
数据在各环节的一致性校验在哪里做的？（前端/后端/数据库）
并发场景下会不会出问题？（竞态条件）

重点建模场景：

支付流程：下单→支付→回调→发货→退款→提现（每个箭头都是攻击点）
认证流程：注册→登录→找回密码→绑定→解绑（每个步骤的凭证传递）
权限模型：角色→权限→资源（每个绑定关系是否可篡改）
审批流程：提交→审核→通过/驳回（能否跳过/重放/篡改状态）

二、支付/资金类场景表（全景）

场景	漏洞类型	挖掘要点
商品下单	金额篡改/数量篡改	价格参数可控、负数/0元/小数精度
优惠券/积分/红包	无限领取/超额使用/叠加	并发领取、ID遍历、多券叠加
支付回调	签名绕过/金额不一致	回调验签缺失、金额未二次校验
退款流程	重复退款/超额退款	并发退款、退款金额可控
提现/转账	越权提现/金额篡改	提现账户可控、余额校验绕过
会员/订阅	越权开通/无限试用	会员等级可控、试用次数绕过
虚拟货币/积分	积分盗刷/负数充值	并发兑换、金额类型混淆
分销/返佣	自推自/刷单	邀请关系可控、返佣逻辑缺陷

三、业务逻辑漏洞攻击套路

支付类：
  - 金额参数篡改（0.01、负数、小数精度）
  - 优惠券/积分/余额叠加
  - 订单状态跳变（未支付→已支付）
  - 并发重放（多次到账）
  - 退款不扣库存

权益类：
  - 无限领取/次数限制绕过
  - 试用→正式状态跳过
  - 会员等级参数可控

流程类：
  - 跳步（绕过前置节点）
  - 重放（同一步骤多次执行）
  - 状态回退/覆盖

四、并发与竞态专项

常见竞态场景

库存扣减：并发下单是否超卖
优惠券领取：并发领取是否多发
提现/转账：并发操作余额是否被重复扣
兑换：积分并发兑换是否重复到账
退款：并发退款是否超额

测试方法

同一请求并发发送（xargs -P / Burp Turbo Intruder / 脚本线程池）
在关键操作（支付回调、发货、领券）同时重放请求
观察数据库/业务结果的最终一致性

修复方向

幂等键：请求唯一标识，重复请求直接返回
数据库约束：唯一索引、余额非负约束、乐观锁
分布式锁 / 事务隔离
服务端二次校验：回调金额与订单金额比对，状态校验原子化

五、验证要点

每个状态转换测试：正常路径、跳过、回退、重放、并发
数据一致性校验位置：前端传参 vs 服务端计算
金额/数量：负数、0、小数精度、类型替换（字符串/数组）
支付回调：验签缺失、金额未二次校验、notify_url 可控
并发结果必须有证据：多次成功响应/数据库记录差异

六、修复建议

金额/价格以服务端为准，禁止信任前端传参
状态转换服务端校验合法性（状态机表驱动）
幂等、唯一约束、分布式锁
回调验签 + 金额二次校验 + 回调防重放

Files

Just SKILL.md in .agents/skills/business-logic-race of zhaji2333/CkSKILLS.

Open the folder on GitHubat commit 482fe78

Compare with similar skills

Business Logic Race next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Business Logic Race compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Business Logic Race this skillzhaji2333/CkSKILLS	115	—	~466	Automated safety check: Pass	MIT	26 days ago
Logical Propertiesthedaviddias/Front-End-Checklist	74k	—	~526	Automated safety check: Pass	MIT	5 days ago
Writing Kea LogicsPostHog/posthog	40k	—	~2.3k	Automated safety check: Pass	Custom licence	yesterday
Logic Reviewsickn33/agentic-awesome-skills	47k	1 repos	~3.5k	Automated safety check: Pass	MIT	2 days ago
Logic Lenssickn33/agentic-awesome-skills	47k	1 repos	~1.3k	Automated safety check: Pass	MIT	2 days ago
Hunt Business Logicsickn33/agentic-awesome-skills	47k	1 repos	~4.9k	Automated safety check: Pass	MIT	2 days ago

Similar skills

Logical Properties
thedaviddias/Front-End-Checklist
A skill your agent uses when reviewing stylesheets, component styles, and responsive behavior related to Use CSS logical properties for i18n and RTL support.
74k GitHub stars~526 tokensUpdated 5 days ago
Frontend & DesignAuto-check passed
Writing Kea Logics
PostHog/posthog
Official
Guide for writing or reviewing PostHog kea logic files (Logic.ts / Logic.tsx).
40k GitHub stars~2.3k tokensUpdated yesterday
Frontend & DesignAuto-check passed
Logic Review
sickn33/agentic-awesome-skills
Find logic bugs in a single file or function via semi-formal execution tracing (Premises → Trace → Divergence → Trigger → Remedy).
47k GitHub starsUsed in 1 repo~3.5k tokens
Auto-check passed
Logic Lens
sickn33/agentic-awesome-skills
AI-powered Claude Code skill that performs deep code review using formal logic and reasoning frameworks to detect bugs, anti-patterns, and security risks beyond what linters catch.
47k GitHub starsUsed in 1 repo~1.3k tokens
DevelopmentAuto-check passed
Hunt Business Logic
sickn33/agentic-awesome-skills
Hunting skill for business logic vulnerabilities. An agent skill from sickn33/agentic-awesome-skills.
47k GitHub starsUsed in 1 repo~4.9k tokens
Auto-check passed
Hunt Race Condition
sickn33/agentic-awesome-skills
Hunting skill for race condition vulnerabilities. An agent skill from sickn33/agentic-awesome-skills.
47k GitHub starsUsed in 1 repo~5.7k tokens
DevelopmentAuto-check passed

More from zhaji2333/CkSKILLS

All 15 skills in this repo

Apk Reversing
zhaji2333/CkSKILLS
当需要获取目标 APK、识别加固壳类型、脱壳还原 dex、反编译得到 Java/so/H5 全量源码产物，或 android-security-audit 需要可直接开挖的输入时调用。负责 APK → 全量可审计产物（壳识别 → 脱壳 → JADX 反编译 + apktool 资源 + so 提取 + H5/assets 提取）→ 标准目录交付。命中场景：JADX 打开是…
115 GitHub stars~1.7k tokensUpdated 26 days ago
Auto-check passed
Asc Fast Hunt
zhaji2333/CkSKILLS
当需要在不对 APK 全量反编译的前提下秒级定位硬编码密钥/签名函数/隐藏接口/调试后门，或 APK 过大（100MB）JADX 全量反编译过慢、内存吃紧，或脱壳产物（裸 dex）需要快速检索，或只想先读一下 Manifest 组件面/权限清单时调用。负责基于 Droid ASC 的零预处理快速定位（findrefs 全局交叉引用搜索 + getclass 按需反编译 + Manifest…
115 GitHub stars~3.3k tokensUpdated 26 days ago
Auto-check passed
AI LLM Agent Security
zhaji2333/CkSKILLS
当目标为 LLM 应用/Chatbot/智能客服/AI 助手/Copilot/Agent/RAG 知识库/多模态模型，或发现用户输入进入大模型提示、工具调用、知识库检索、对话记忆、文件解析，或需要测试提示词注入/越狱逃逸/System Prompt 泄露/训练数据与敏感信息泄露/RAG 检索污染/Agent 记忆污染/工具滥用与命令执行/SSRF/沙箱逃逸时调用。负责 OWASP LLM…
115 GitHub stars~4.7k tokensUpdated 26 days ago
Auto-check: warnings
Hunt Clueboard
zhaji2333/CkSKILLS
当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板，或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板（读→挖→写回），不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。
115 GitHub stars~606 tokensUpdated 26 days ago
Auto-check passed
Cloud Infra Supply Chain
zhaji2333/CkSKILLS
当目标涉及云资产（对象存储/云元数据/Serverless）、容器/K8s、运维面板（宝塔/Grafana/Zabbix/Jenkins/GitLab/Nacos等）、消息队列/缓存中间件、CI/CD流水线、第三方回调集成、依赖组件CVE、信息泄露配置时调用。负责未授权访问、弱口令、云配置错误、供应链漏洞与敏感信息挖掘。
115 GitHub stars~688 tokensUpdated 26 days ago
Auto-check: warnings
Injection Vulns
zhaji2333/CkSKILLS
当发现参数拼接SQL、动态排序/筛选、JSON查询条件可控、模板渲染、命令执行点、搜索/统计/自动补全接口时调用，进行SQL/NoSQL/命令/SSTI/表达式注入的深度挖掘。命中场景：搜索框、排序参数、登录绕过、导出条件、文件名参数、模板/报表生成、爬虫URL参数。
115 GitHub stars~579 tokensUpdated 26 days ago
Auto-check passed

Questions about Business Logic Race

What does Business Logic Race do?

当目标存在支付/下单/退款/提现/转账/优惠券/积分/红包/会员/订阅/审批/库存/抽奖等业务功能，或发现状态可跳变、金额参数可控、并发可重放时调用。负责业务状态机建模、金额篡改、订单状态跳变、竞态条件与重放攻击深度挖掘。. Business Logic Race is an agent skill from zhaji2333/CkSKILLS.

How do I install Business Logic Race in Claude Code?

Run `npx skills add zhaji2333/CkSKILLS --skill business-logic-race -a claude-code`. Or copy the skill folder (.agents/skills/business-logic-race in zhaji2333/CkSKILLS) into .claude/skills/business-logic-race in your project. Claude Code loads it when a task matches its description.

How do I install Business Logic Race in Codex?

Run `npx skills add zhaji2333/CkSKILLS --skill business-logic-race -a codex`. Or copy the skill folder (.agents/skills/business-logic-race in zhaji2333/CkSKILLS) into .agents/skills/business-logic-race in your project. Codex loads it when a task matches its description.

Can I use Business Logic Race in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add zhaji2333/CkSKILLS --skill business-logic-race -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/business-logic-race, .gemini/skills/business-logic-race, .github/skills/business-logic-race and .opencode/skills/business-logic-race in your project.

What does Business Logic Race need to run?

SKILL.md names no scripts, command-line tools or credentials: Business Logic Race is instructions for the agent only.

Does Business Logic Race access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Business Logic Race safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Business Logic Race use?

Business Logic Race is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Business Logic Race use?

About 466 tokens (SKILL.md is roughly 1.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Business Logic Race?

Skills that share tags, products or a category with Business Logic Race: Logical Properties (thedaviddias/Front-End-Checklist, 74k stars), Writing Kea Logics (PostHog/posthog, 40k stars), Logic Review (sickn33/agentic-awesome-skills, 47k stars) and Logic Lens (sickn33/agentic-awesome-skills, 47k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Business Logic Race?

zhaji2333 (a GitHub user) maintains it in zhaji2333/CkSKILLS, which has 115 GitHub stars. The repository holds 15 skills in this directory. The repository was last updated on September 15, 2026.

Source: zhaji2333/CkSKILLS on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Business Logic Race

Facts

At a glance

What it does

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

business-logic-race — 业务逻辑与并发竞态专项深度挖掘

何时调用（触发条件）

一、业务逻辑建模（先理解再测试）

二、支付/资金类场景表（全景）

三、业务逻辑漏洞攻击套路

四、并发与竞态专项

常见竞态场景

测试方法

修复方向

五、验证要点

六、修复建议

Files

Compare with similar skills

Similar skills

More from zhaji2333/CkSKILLS

Questions about Business Logic Race