sast-businesslogic Skill Review: 21,213 Bytes and a Cost Goal With No Cost Numbers

The README of utkusen's sast-skills says its "main goal" is "to find as many vulnerabilities as possible at the lowest possible cost". That README is 3,361 bytes and contains no detection rate, no false-positive rate and no cost figure. The repo has 1,351 stars, and its issue tracker has never held a single issue.

I reviewed sast-businesslogic, the skill that has to catch bugs no regex can: negative quantities, double-spent coupons, skipped payment steps. I read its full SKILL.md, the CLAUDE.md orchestrator and the README, then checked the repo's pull request, npm metadata and install telemetry. I did not run it, so nothing below is a measured cost. Token figures are file bytes divided by 4, arithmetic you can redo.

What the skill actually says

It's a three-phase pipeline. Phase 1 reads sast/architecture.md and writes numbered attack scenarios against 12 categories: price manipulation, quantity limits, workflow bypass, coupon abuse, race conditions, refunds, referral farming, entitlement bypass, auctions, inventory, time logic and transfers. Phase 2 splits the scenarios into batches of three and launches one subagent per batch, in parallel. Phase 3 merges the batch files. Each scenario ends as Exploitable, Likely Exploitable, Not Exploitable or Needs Manual Review. Three lines show its character:

The first is the right instinct, since logic flaws can't be pattern-matched. The third is a deliberate lean toward noise: "False negatives in a security assessment are worse than false positives."

Security gate: the skill is markdown with no scripts, and I read all 21,213 bytes. The only curl strings sit inside report templates, in a "Dynamic Test" field where the agent writes steps for a human to run. Nothing in the skill executes them. The frontmatter has no allowed-tools, and none of the 16 skills declare one.

What it costs you in context

Arithmetic from file sizes, not a session measurement: bytes ÷ 4.

The all-skills row is not one session's cost. The 14 detectors range from 18,773 bytes (graphql) to 33,624 (rce), about 4,693 to 8,406 estimated tokens each, and the orchestrator runs them as separate parallel subagents. File sizes also leave out what matters most: the application code each subagent reads. The skill's own example says 10 scenarios means "4 subagents (3+3+3+1)". There's no cap on scenario count.

What the community reports

Public discussion is thin. A GitHub search found no issues at all. Hacker News (Algolia, stories and comments) had no hits for "sast-skills" or for two other phrasings; searching the author's handle returned only his older, unrelated posts. Web search returned only directory and auto-generated pages that restate the README. I found no hands-on write-up and no dissenting user. What exists:

The npm row matters. PR #1 says the package name was unclaimed in April and suggests publishing it under the owner's account. Per the registry it was created on 2026-06-26 under mstfknn. So npx sast-skills runs a third party's package. I didn't read its code; I only note it isn't the repo this review covers.

How to install it

The README shows one manual route; I did not run it.

# from the README: copy your project into the repo's sast-files folder
cp -r /path/to/your/project sast-files/
# then open sast-files as the workspace and ask:
#   "Run vulnerability scan"

The README warns that if your project already has a CLAUDE.md or AGENTS.md, you must remove it first. A second route comes from the skills.sh page, not the README: npx skills add utkusen/sast-skills. I don't know whether that route installs the orchestrator file; without it the scan doesn't run automatically.

Where it earns its keep, and where it doesn't

It earns its keep on apps that handle money, quotas, coupons or multi-step state: shops, marketplaces, booking and subscription code. The 12-category list works as a human review checklist even if you never run the pipeline.

It earns little on libraries and CLIs, or where the rules live in database triggers and third-party services that the agent can't see. It's also a poor fit if you need numbers before adopting a scanner; none exist.

The criticisms are concrete:

• The stated goal has no evidence. "Lowest possible cost" appears in the README. No cost, recall or false-positive figure does.
• AGENTS.md skips a detector. It has 13 "Skip" lines against 14 in CLAUDE.md and never mentions hardcoded secrets, even though the skill sits in the folder. The mismatch is still there at commit 3a5bf8f (2026-10-23).
• Findings are static hypotheses. The "Dynamic Test" curl steps go into the report but never run, so "Exploitable" means the model read the code and believes it.
• It leans toward noise. The "when in doubt" rule and the "false negatives are worse" line push toward flagging, and the main branch has no triage step.
• The fan-out is uncapped. Batches scale with scenario count and the detectors run in parallel, yet no cost is stated.
• It looks dormant. This skill has 2 commits, the last on 2026-03-31, 213 days ago. The repo has 7 commits in total; six landed in the first 10 days and one README edit followed 198 days later.

FAQ

What does the sast-businesslogic skill do?

It tells a coding agent to threat-model an application's business rules, test each attack scenario in parallel subagents (3 scenarios per subagent), and merge the results into one report. It covers 12 categories such as price manipulation, coupon abuse, race conditions and workflow bypass. SKILL.md is 21,213 bytes.

How much context does sast-businesslogic use?

By file-size arithmetic (bytes ÷ 4, an estimate, not a measured session cost): about 5,303 tokens for SKILL.md, and about 7,223 with the sast-analysis prerequisite and the CLAUDE.md orchestrator. The 542-byte description, always loaded, is about 136. Subagent work on your own code is not included.

Does sast-skills publish accuracy or cost numbers?

No. The 3,361-byte README states a goal of finding vulnerabilities at the lowest possible cost but gives no detection rate, false-positive rate or cost figure. As of 2026-10-30 the repository has had 0 issues and 1 open pull request, unanswered for 192 days.

Is npx sast-skills the official install?

Not from the README, which shows only a manual copy into a sast-files folder. The npm package named sast-skills (version 0.10.0, created 2026-06-26) lists mstfknn as its maintainer and points to that user's fork, not utkusen's repository. This review did not read the package's code.

Skill by Utku Sen (utkusen), MIT licensed (LICENSE file: "Copyright (c) 2026 Utku Sen"). Source: github.com/utkusen/sast-skills, reviewed at commit 3a5bf8f (2026-10-23). Review date October 30, 2026. Quoted lines are short excerpts for review purposes. Star counts, install counts and pull request states are as of this date, and community reception shifts over time. Token figures are estimates from file size.