How do I install the Auditing Business Logic skill?

Run npx skillmds@latest add googlecloudplatform/auditing-business-logic in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Auditing Business Logic safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Auditing Business Logic?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Auditing Business Logic free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Auditing Business Logic?

GoogleCloudPlatform (@googlecloudplatform) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Auditing Business Logic by googlecloudplatform

Name: Auditing Business Logic
Author: GoogleCloudPlatform

Auditing Business Logic

Analyzes authentication flows, authorization rules, middleware logic, and side-effects. Use when extracting business rules, Passport configurations, or mailer logic from an Express application.

File contents

Auditing Business Logic & Side-Effects

Analyze the implicit "rules" and external behaviors of a legacy application to ensure they are accurately replicated in the modern architecture.

Objective

Reverse-engineer the application's authentication flows, authorization logic (RBAC/ABAC), and any asynchronous side-effects (Mailers, External APIs, File Storage).

Instructions for the Audit Subagent

Copy this checklist and track your progress:

Task Progress:
- [ ] Step 1: Analyze AuthN & AuthZ Flows
- [ ] Step 2: Map Side-Effects (External APIs, Mailers)
- [ ] Step 3: Analyze Global Middleware
- [ ] Step 4: Draft Modernization Advisory
- [ ] Step 5: Generate Business_Logic_Rules.md

Step 1. Analyze AuthN & AuthZ Flows

Authentication (AuthN): Locate Passport, session, or JWT configurations (e.g., config/passport.js). Document the login strategies (Local, OAuth, etc.) and required fields.
Authorization (AuthZ): Document the logic used for access control. How does the system verify a user's role or ownership of a Primary Resource? (e.g., requiresRole('admin') or isOwner(resource_id)).

Step 2. Map Side-Effects

Identify actions that occur outside of the primary request/response cycle:

External Services: Check package.json and controllers for Stripe (Payments), Twilio (SMS), SendGrid (Email), etc.
Mailers: Audit the mailer/ or services/email/ directory. Does creating a resource trigger an automated notification?
File Storage: Locate file upload configurations (e.g., Multer). Determine where assets are stored (Local Disk vs Cloud Storage).

Step 3. Analyze Global Middleware

Examine app.js or config/express.js. Document global middlewares such as helmet, cors, custom loggers, or csurf. Determine which remain relevant for a modern Next.js API.

Step 4. Provide Modernization Advisory

Flag potential pitfalls for the modern stack (e.g., Next-Auth vs Passport). Recommend modern equivalents for legacy side-effects (e.g., moving from local file storage to S3/Uploadthing).

Step 5. Generate Business_Logic_Rules.md & Identify Probes

Compile findings into docs/legacy-audit/Business_Logic_Rules.md. Additionally, identify specific logic-parity probes (e.g., "Attempt to submit a form without the required OAuth session to verify the redirect loop matches legacy"). Append these logic-specific test cases to docs/verification/Verification_Plan.md.

---name: auditing-business-logicdescription: Analyzes authentication flows, authorization rules, middleware logic, and side-effects. Use when extracting business rules, Passport configurations, or mailer logic from an Express application.---# Auditing Business Logic & Side-EffectsAnalyze the implicit "rules" and external behaviors of a legacy application to ensure they are accurately replicated in the modern architecture.## ObjectiveReverse-engineer the application's authentication flows, authorization logic (RBAC/ABAC), and any asynchronous side-effects (Mailers, External APIs, File Storage).## Instructions for the Audit SubagentCopy this checklist and track your progress:```Task Progress:- [ ] Step 1: Analyze AuthN & AuthZ Flows- [ ] Step 2: Map Side-Effects (External APIs, Mailers)- [ ] Step 3: Analyze Global Middleware- [ ] Step 4: Draft Modernization Advisory- [ ] Step 5: Generate Business_Logic_Rules.md```### Step 1. Analyze AuthN & AuthZ Flows- **Authentication (AuthN)**: Locate Passport, session, or JWT configurations (e.g., `config/passport.js`). Document the login strategies (Local, OAuth, etc.) and required fields.- **Authorization (AuthZ)**: Document the logic used for access control. How does the system verify a user's role or ownership of a **Primary Resource**? (e.g., `requiresRole('admin')` or `isOwner(resource_id)`).### Step 2. Map Side-EffectsIdentify actions that occur outside of the primary request/response cycle:- **External Services**: Check `package.json` and controllers for Stripe (Payments), Twilio (SMS), SendGrid (Email), etc.- **Mailers**: Audit the `mailer/` or `services/email/` directory. Does creating a resource trigger an automated notification?- **File Storage**: Locate file upload configurations (e.g., Multer). Determine where assets are stored (Local Disk vs Cloud Storage).### Step 3. Analyze Global MiddlewareExamine `app.js` or `config/express.js`. Document global middlewares such as `helmet`, `cors`, custom loggers, or `csurf`. Determine which remain relevant for a modern Next.js API.### Step 4. Provide Modernization AdvisoryFlag potential pitfalls for the modern stack (e.g., Next-Auth vs Passport). Recommend modern equivalents for legacy side-effects (e.g., moving from local file storage to S3/Uploadthing).### Step 5. Generate Business_Logic_Rules.md & Identify ProbesCompile findings into `docs/legacy-audit/Business_Logic_Rules.md`. Additionally, **identify specific logic-parity probes** (e.g., "Attempt to submit a form without the required OAuth session to verify the redirect loop matches legacy"). **Append** these logic-specific test cases to `docs/verification/Verification_Plan.md`.

Frequently asked questions