user-flow-audit

Models user flows as state machines to detect dead ends, skippable steps, and refresh or back-button desyncs.

Updated Aug 29, 2026
One-click install
npx skills add https://github.com/1arley/volibear --skill user-flow-audit-1arley
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: user-flow-audit
Source: https://github.com/1arley/volibear/tree/main/.opencode/skills/user-flow-audit
Command: npx skills add https://github.com/1arley/volibear --skill user-flow-audit-1arley

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Multi-step flows like onboarding, checkout, and wizards often hide defects: states users cannot escape, steps that can be skipped by calling endpoints directly, and state corruption caused by refresh or the back button. This Skill gives an agent a systematic method to model any flow as a state machine and hunt for these structural bugs. ## Core Features & Use Cases - State Machine Modeling: Maps any flow as entry → preconditions → action → state change → feedback → next state, labeling where each state lives (server, client, URL, cache). - Defect Detection Patterns: Tests for dead ends, skippable preconditions, impossible states, refresh/back-button desyncs, duplicate operations, and stale feedback. - Confidence-Graded Findings: Reports issues with evidence levels from CONFIRMED to SPECULATIVE, plus false-positive filters to avoid noise. - Use Case: Auditing a checkout flow to verify that calling the final payment endpoint directly without completing prior steps is rejected server-side, and that pressing back after submission cannot create a duplicate order. ## Quick Start Audit the onboarding flow in this repository and report any dead ends, skippable steps, or refresh and back-button problems as a state machine diagram with findings.

Frequently Asked Questions about user-flow-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a multi-step user flow for bugs?▼

Model the flow as a state machine with nodes for each persisted state and transitions for each action. Then test each transition's preconditions, check every state for a legitimate exit, and probe refresh, back-button, and double-submit behavior at each step.

How to test if checkout or wizard steps can be skipped?▼

Call the endpoint of a later step directly without completing earlier steps. If the server assumes prior steps instead of verifying them, the step is skippable and the flow has a precondition bypass vulnerability.

What is a dead end state in a user flow?▼

A dead end is a state from which no legitimate action leads to a useful next state, such as a payment_failed screen with no retry or cancel option. Some terminal states like banned accounts are intentional and should be reported as product decisions, not defects.

Why does pressing refresh or back break multi-step forms?▼

Breakage happens when flow state lives only in the client and is lost on refresh, or when the back button returns to an obsolete state that allows re-executing a non-idempotent action. Server-side state reconstruction and idempotency keys prevent these issues.

When should a flow issue not be reported as a bug?▼

Skip reporting when the server verifies preconditions for each step, when re-execution is genuinely idempotent, when intermediate states are purely visual UI feedback, or when button disabling plus server idempotency already prevents duplication.