Agent skill · security · yaklang
race-condition
Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 single-packet attacks, and CWE-362-style synchronization gaps.
Why this skill is useful
Adds detailed testing procedures and attack patterns for identifying race conditions and TOCTOU vulnerabilities that are not commonly documented.
What it needs
About 10k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Race Conditions — Testing & Exploitation Playbook AI LOAD INSTRUCTION: Treat race conditions as authorization/state integrity issues: non-atomic read-then-write lets multiple requests observe stale state. Prioritize one-time or balance-like operations. Combine parallel transport (HTTP/1.1 last-byte sync, HTTP/2 single-packet, Turbo Intruder gates) with application evidence (duplicate success responses, inconsistent balances, duplicate ledger rows). Authorized testing only. Routing note: for business workflows, coupons, inventory, or one-time rewards, start with this skill and cross-load business-logic-vulnerabilities. --- 0. QUICK START — What to Test First Target endpoints where check and update are unlikely to be a single atomic database operation: Priority Operation class Example paths / parameters ---------- ------------------ ---------------------------- 1 One-time redeem / coupon / bonus redeem, applycoupon, claimreward, voucher 2 Balance / quota / stock deduction transfer, purchase, reserve, inventory 3 Invite / referral / signup bonus inviteaccept, referralclaim 4 Password / email / MFA verification verifytoken, confirmemail, resetpassword 5 Idempotent-looking APIs without strong keys POST that should succeed only once per user First moves (conceptual): 1. Capture the state-changing request in a proxy. 2. Send 20–100 copies as simultaneously as your tooling allows. 3. Classify outcome: 0/1 expected successes vs N successes or inconsistent final state. --- 1. CORE CONCEPT 1.1 TOCTOU (Time-of-check to time-of-use) TOCTOU means the decision (check) and the mutation (use) are not one indivisible step. 1.2 Non-atomic read-then-write Typical vulnerable pseudo-flow: Two concurrent requests can both pass the if before either UPDATE commits. 1.3 Database-level vs application-level locking gaps Layer What goes wrong ------- ------------------ Application In-memory flag, cache, or session says "not used yet" while DB already updated — or the reverse. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/race-condition