race-condition

Race condition / TOCTOU exploitation — concurrent and parallel-request attacks against web applications that check then act, write session state before validating it, or perform slow operations that widen the race window. Covers single-endpoint races (double-spend, coupon abuse, balance overflow) and multi-endpoint state-leak races where a session write on one endpoint leaks privilege into another endpoint mid-request.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured skill with executable code and explicit validation checkpoints; the only minor gap is slight verbosity and a single-file structure that borders on long.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence with Python/requests, with only minor restating between the intro paragraph and the Recognition Signals section that could be tightened.	4 / 5
Actionability	Provides fully executable, copy-paste-ready concurrent.futures/requests code with clear placeholders for both single-endpoint and multi-endpoint races, plus stated win conditions.	5 / 5
Workflow Clarity	Clear sequence (recognize -> probe -> verify) with explicit 'Verification (≥3 reproductions)' checkpoints and re-run feedback loops, plus a decision tree — satisfying the batch-operation validation requirement.	5 / 5
Progressive Disclosure	Well-organized single-file skill with clear section headers and no nested references; no bundle files exist so reference signaling is not applicable, but the file is somewhat long for a single monolithic document.	4 / 5
	Total	18 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description with strong distinctiveness, but it lacks an explicit 'Use when' trigger clause, capping completeness at 3 despite thorough capability listing.

Suggestions

Add an explicit 'Use when...' sentence to the description (e.g., 'Use when testing for race conditions, TOCTOU, or concurrent-request vulnerabilities in web apps') so trigger guidance lives in the description, not just metadata.

Fold a few high-value synonyms currently only in when_to_use (e.g., 'check-then-act', 'time-of-check time-of-use') into the description to improve trigger-term completeness.

Dimension	Reasoning	Score
Specificity	Names multiple concrete attack patterns — 'check then act', 'write session state before validating it', 'double-spend, coupon abuse, balance overflow', and 'multi-endpoint state-leak races where a session write on one endpoint leaks privilege into another endpoint' — giving comprehensive coverage rather than vague language.	5 / 5
Completeness	The 'what' is clear and detailed, but there is no explicit 'Use when...' clause or equivalent trigger guidance in the description, which per the rubric caps completeness at 3.	3 / 5
Trigger Term Quality	Includes natural practitioner terms ('race condition', 'TOCTOU', 'concurrent', 'parallel-request', 'double-spend', 'coupon abuse'), but several synonyms ('time-of-check time-of-use', 'check-then-act', 'last-write-wins') appear only in the when_to_use metadata rather than the description itself.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (web TOCTOU/race exploitation) and even disambiguates a neighboring attack (smuggling is not a race), giving minimal conflict risk with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/race-condition/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.