race-condition

Identify race conditions and TOCTOU patterns in web applications.

1.6k|204|Updated Apr 7, 2026

Search Tags:#concurrency #web-security #api-testing #security-testing #vulnerability-analysis #race-condition #toctou

Ready to run

npx skills add https://github.com/yaklang/hack-skills --skill race-condition-yaklang

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: race-condition
Source: https://github.com/yaklang/hack-skills/tree/main/skills/race-condition
Command: npx skills add https://github.com/yaklang/hack-skills --skill race-condition-yaklang

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Race conditions and TOCTOU vulnerabilities in web applications can cause inconsistent state, duplicate actions, and security gaps when multiple clients perform check-then-act sequences concurrently.

Core Features & Use Cases

TOCTOU awareness: guides testing of non-atomic read-then-write flows in APIs handling one-time operations, balances, and quotas.
Concurrency patterns: covers parallel request scenarios, idempotency challenges, and race windows in multi-step workflows.
Remediation guidance: offers practical mitigations like proper locking, transactions, and idempotency keys to close race windows.

Quick Start

Run parallel requests against a sensitive endpoint that performs a one-time operation to observe race-condition behavior and document any non-atomic updates.

Frequently Asked Questions about race-condition

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for race conditions in web applications?▼

To test for race conditions in web applications, use a controlled test harness to generate parallel traffic against sensitive endpoints performing one-time operations, then observe outcomes for inconsistent state caused by non-atomic updates.

What is a TOCTOU vulnerability and when does it occur?▼

A TOCTOU vulnerability occurs when non-atomic read-then-write flows in APIs are exploited by concurrent requests. It affects endpoints handling one-time operations, balances, and quotas where check-then-act sequences lead to inconsistent state.

What's the best way to exploit race conditions in multi-step workflows?▼

The best way to exploit race conditions in multi-step workflows is to apply concurrency patterns by sending parallel requests during race windows, observing if idempotency challenges allow duplicate actions or state changes.

How do I fix race conditions and secure concurrent API requests?▼

To fix race conditions and secure concurrent API requests, implement remediation guidance such as proper locking, database transactions, and idempotency keys to close race windows and ensure transactional integrity.

Can I test API endpoints for concurrency issues without affecting production state?▼

Yes, you can test API endpoints for concurrency issues safely by using a controlled test harness to generate parallel traffic and validate fixes, ensuring non-atomic updates are observed without risking production state.