Identify race conditions and TOCTOU patterns in web applications.
npx skills add https://github.com/yaklang/hack-skills --skill race-condition-yaklang
Please help me install this Agent Skill. Skill: race-condition Source: https://github.com/yaklang/hack-skills/tree/main/skills/race-condition Command: npx skills add https://github.com/yaklang/hack-skills --skill race-condition-yaklang
Race conditions and TOCTOU vulnerabilities in web applications can cause inconsistent state, duplicate actions, and security gaps when multiple clients perform check-then-act sequences concurrently.
Run parallel requests against a sensitive endpoint that performs a one-time operation to observe race-condition behavior and document any non-atomic updates.
High-intent search queries and answers about installing and using this skill.
To test for race conditions in web applications, use a controlled test harness to generate parallel traffic against sensitive endpoints performing one-time operations, then observe outcomes for inconsistent state caused by non-atomic updates.
A TOCTOU vulnerability occurs when non-atomic read-then-write flows in APIs are exploited by concurrent requests. It affects endpoints handling one-time operations, balances, and quotas where check-then-act sequences lead to inconsistent state.
The best way to exploit race conditions in multi-step workflows is to apply concurrency patterns by sending parallel requests during race windows, observing if idempotency challenges allow duplicate actions or state changes.
To fix race conditions and secure concurrent API requests, implement remediation guidance such as proper locking, database transactions, and idempotency keys to close race windows and ensure transactional integrity.
Yes, you can test API endpoints for concurrency issues safely by using a controlled test harness to generate parallel traffic and validate fixes, ensuring non-atomic updates are observed without risking production state.
ok-helloworldDetect race-condition and TOCTOU vulnerabilities via synchronized parallel HTTP requests.
cosmixApply concurrency patterns to mitigate race conditions and deadlocks.
xlelibertyPerform offensive security assessments with vulnerability scanning and penetration testing.
0x1337c0d3Identify and analyze race condition vulnerabilities in source code for TOCTOU and shared-state issues.
