# Detecting Logic Bypass > Detects logic bypass vulnerabilities including authentication bypass, authorization bypass, and business logic flaws. Use when analyzing authentication mechanisms, access controls, or investigating security control bypasses. Use when this capability is needed. - Skill: `tomevault-io/detecting-logic-bypass` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/detecting-logic-bypass` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/detecting-logic-bypass/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: AI & ML - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/detecting-logic-bypass --- # Logic Bypass Detection ## Detection Workflow 1. **Identify security controls**: Find authentication mechanisms, authorization checks, validation functions, business logic rules 2. **Trace control flow**: Use `xrefs_to` to trace paths, identify bypass opportunities, check for missing checks 3. **Check validation logic**: Review validation functions, test bypass scenarios, assess validation completeness 4. **Assess bypass impact**: What security control is bypassed? What's the business impact? How severe is the bypass? ## Key Patterns - Authentication bypass: weak password checks, session token weaknesses, timing attacks - Authorization bypass: missing permission checks, insecure direct object references, privilege escalation - Input validation bypass: blacklist-based validation, insufficient sanitization, regex bypass - Business logic bypass: race conditions, state manipulation, transaction abuse ## Output Format Report with: id, type, subtype, severity, confidence, location, vulnerability, security control, bypass method, attack scenario, bypass steps, exploitability, impact, mitigation. ## Severity Guidelines - **CRITICAL**: Complete bypass of primary security control - **HIGH**: Bypass of important security control - **MEDIUM**: Partial bypass or edge case bypass - **LOW**: Limited bypass with minor impact ## See Also - `patterns.md` - Detailed detection patterns and exploitation scenarios - `examples.md` - Example analysis cases and code samples - `references.md` - CWE references and mitigation strategies --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/waiwai24) — claim your Tome and manage your conversions.