10 actions in 3 pieces of software · ranked by words, meaning and measured trust · 591 ms

1. 1business-logic-vulndemo or tutorialno passport yet

   skillyaklang/hack-skillsrecord

   • business-logic-vuln

     Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection.

2. 2business-logic-vulnerabilitiesdemo or tutorialno passport yet

   skillyaklang/hack-skillsrecord

   • business-logic-vulnerabilities

     Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps.

3. 3vuln-mcpfound in code, not yet checkedno passport yet

   MCP serverakto-api-security/vuln-mcp

   • get_customer_information

     Business goal: Get customer information.

   • get_customer_info_detailed

     Business goal: Get customer information.

   • generate_shipping_label

     Business goal: Initiate carrier OAuth and generate a label. Vulnerability: Unvalidated OAuth URL execution Realistic impact: Executes arbitrary URLs/commands (RCE/UI hijack).

   • get_order_invoice

     Business goal: Retrieve an order's invoice (PDF/log) for customer support. Vulnerability: Path traversal via naive path checks Realistic impact: Read /etc/passwd, API keys, or service configs. Allowed base: /var/app/invoices/

   • process_refund

     Business goal: Process payment refunds via internal CLI. Vulnerability: Command injection via unsanitized shell command Realistic impact: Arbitrary command execution under service account. Risky pattern: refund-cli --order {order_id} --amount {amount} --reason "{reason}"

   • validate_webhook_signature

     Business goal: Validate carrier/3PL webhook payloads and extract shipment status. Vulnerability: Insecure deserialization (pickle/yaml.load) Realistic impact: Remote code execution via crafted webhook payload. Args: payload_b64: base64-encoded serialized object format_type: "pickle" | "yaml" | "json

   • marketing_etl_import

     Business goal: Pull marketing campaign data into the data warehouse. Vulnerability: Hardcoded secrets + full env dump (credential exposure) Realistic impact: Exfiltrate API keys, DB creds, analytics tokens. Example use: auditing ETL run parameters (but leaks everything).

   • import_product_descriptions

     Business goal: Fetch rich product descriptions (HTML/markdown) from CMS for downstream AI-assisted formatting and SEO enrichment. Prompt Injection Risk (indirect): - The fetched content can contain hidden instructions in HTML comments, markdown, or innocuous-looking text that later gets passed to an