Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add viknesh20-20/claude-code-tool-kit --skill business-logic-auditgit clone --depth 1 https://github.com/viknesh20-20/claude-code-tool-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/viknesh20-20/claude-code-tool-kit/business-logic-audit)<a href="https://agentmods.dev/skills/viknesh20-20/claude-code-tool-kit/business-logic-audit"><img src="https://agentmods.dev/badge/skills/viknesh20-20/claude-code-tool-kit/business-logic-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/viknesh20-20/claude-code-tool-kit/business-logic-audit"><img src="https://agentmods.dev/badge/skills/viknesh20-20/claude-code-tool-kit/business-logic-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.02161 |
| Opus 5 | $0.00032 | $0.01081 |
| Sonnet 5 | $0.00013 | $0.00432 |
| Haiku 4.5 | $0.00006 | $0.00216 |
Grade A, and why
business-logic-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 196 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/business-logic-audit
Audit a feature or module for the edge cases that break in production. Different from /review-pr (which reviews diffs) — this skill walks code that's already shipped and looks for the failure modes the original implementer missed.
When to use
- Before scaling a feature to higher traffic / bigger customers / new regions.
- After an incident touched a business invariant.
- Before a SOC 2 / PCI / HIPAA audit.
- When taking ownership of someone else's code that handles money or regulated data.
- When a competitor's incident shows a class of failure you haven't checked for.
Operating method
1. Lock down scope
Ask:
- What feature / module / domain? Be specific — "the checkout flow," "subscription billing," "inventory reservation," "multi-tenant search."
- What's the worst-case failure? Lost charge, double charge, leaked tenant data, audit fail, etc. We'll prioritize the audit around it.
- What's the deployment context? Dev / staging / prod. Some checks (rate limits, tax) only matter in prod.
2. Walk the relevant edge-case checklist
For each finding, classify by category and severity. Categories below — pick the ones that apply.
Money handling
- All monetary values stored in minor units as integers. Critical if floats are used.
- Every monetary value has an explicit currency code. High if missing.
- Rounding rule documented at every site that rounds. Medium.
- FX rate snapshotted at transaction time. High for multi-currency.
- Refunds, adjustments, chargebacks are append-only. Critical if rows are mutated.
- Tax calculation through Stripe Tax / Avalara / TaxJar (not hand-rolled). High for non-US jurisdictions.
- Invoice numbers are sequential per legal entity, immutable once issued. High.
State machines
- Legal transitions defined in code (enum + guard) or DB constraint, not just UI. High.
- Every transition logged with actor + timestamp + before + after. High.
- Race conditions on transitions handled (row locks or unique constraints). Critical for concurrent scenarios.
- Reversible vs one-way transitions documented. Medium.
- State machine matches the real business workflow (no impossible states reachable). High.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 196 lines · 63 tokens per session scan A 89c1da9446a2
business-logic-audit is a skill published in the GitHub repository viknesh20-20/claude-code-tool-kit (7 stars, last pushed 4mo ago), licensed MIT. It adds 63 tokens to every session and 2,161 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
gh-find-prs
Survey open Codewhale PRs and triage each for mergeability and disposition against the real landing branch.
improve
Autonomous quality improvement loop. Scores a target against a rubric, selects the highest-leverage axis, attacks it, verifies, documents, and loops. No pre-planning between iterations — each loop re-scores from scratch.
triage
GitHub issue and PR investigator. Pulls open issues/PRs, classifies them, searches the codebase for root cause or reviews contributed code, proposes fixes with file:line references, and optionally implements fixes. Use for investigating GitHub issues and reviewing PRs; do NOT use for general code review unrelated to…
code-review-pipeline
Multi-dimensional code review across correctness, security, performance, and maintainability with confidence-gated reporting and remediation loops.
code-review-patterns
Multi-dimensional code assessment across security, quality, performance, and maintainability with confidence-gated reporting (>=80%) and Router Contract generation.
verification
Verification-before-completion discipline ensuring all success criteria are met, tests pass, and reviews complete before declaring work done.