offensive-toctou

Time-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symbolic-link races (open/access/stat split), file-descriptor races, fopen/realpath traversal races, /proc and procfs races, FUSE-backed slow-fs races to widen the window, ptrace and signal races, kernel double-fetch / userspace pointer races, container/runc/symlink escape primitives, kubernetes admission/authz TOCTOU, web auth-vs-authz TOCTOU, JWT-claim TOCTOU at gateway vs service, payment/idempotency races, and modern race-amplification techniques (single-packet attack, slow loris, FUSE pause, cgroup freeze, scheduler shaping). Use when you've identified a 'check then act' pattern in code, when fuzzing for race conditions, or when exploiting concurrency bugs in privileged binaries / kernel / orchestrators.

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

90%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, token-efficient exploitation reference with executable code and a clear top-level workflow. The main improvements are stronger per-technique validation checkpoints and splitting some large inline sections into reference files.

Suggestions

Add explicit per-technique validation/verification steps (e.g. 'after each swap, confirm via lstat that the target inode changed before claiming success') to push workflow clarity toward the fully-checkpointed anchor.

Move the race loop templates and/or the detection tooling table into a dedicated reference file (e.g. references/templates.md) and link from the body, reducing the ~340-line body and improving progressive disclosure.

Consider extracting the layer-by-layer CVE/technique catalog (container escapes, /proc races, web TOCTOU) into a references/catalog.md so SKILL.md stays a concise overview.

Dimension	Reasoning	Score
Conciseness	Dense and lean throughout: every section delivers concrete primitives, code, or named CVEs with no padding and no explanation of concepts Claude already knows (e.g. no 'what a library is' filler), so every token earns its place.	5 / 5
Actionability	Provides copy-paste-ready executable code in C, bash, and Python (e.g. the renameat2 RENAME_EXCHANGE snippet, the FUSE SlowFS handler, the httpx single-packet race), plus a tooling table and named commands covering the common cases.	5 / 5
Workflow Clarity	A clear 5-step Quick Workflow with a verify step ('confirm the post-use state corresponds to the swapped target') and a Reporting section mandating success-rate demonstration, but per-technique validation checkpoints are only lightly signaled, so it sits below the fully-checkpointed anchor.	4 / 5
Progressive Disclosure	Well-sectioned single-file body with clear headers and navigation, but at ~340 lines substantial inline blocks (race loop templates, the full tooling table, mobile/binary cookbook) could be split into reference files; no bundle files exist to offset this.	4 / 5
	Total	18 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, complete, and well-triggered description that names concrete exploitation primitives and gives explicit use-when guidance. Minor gap in natural-keyword synonyms is the only thing keeping it from full marks across the board.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete exploitation actions across named layers — 'symbolic-link races (open/access/stat split)', 'kernel double-fetch / userspace pointer races', 'container/runc/symlink escape primitives', 'JWT-claim TOCTOU at gateway vs service', 'single-packet attack' — giving comprehensive coverage rather than generic verbs.	5 / 5
Completeness	Explicitly answers both what ('TOCTOU race condition exploitation methodology across binary, kernel, filesystem, web, and container layers') and when ('Use when you've identified a check then act pattern in code, when fuzzing for race conditions, or when exploiting concurrency bugs'), with concrete trigger phrases.	5 / 5
Trigger Term Quality	Strong natural keywords including 'check then act', 'race conditions', 'fuzzing', 'concurrency bugs', and 'TOCTOU' with synonyms, but a few common user phrases (e.g. 'race bug', 'timing attack') are absent, keeping it just below comprehensive.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (TOCTOU exploitation across specific named layers with named CVE primitives and techniques) with distinct triggers, making conflict with other skills minimal.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: SnailSploit/Claude-Red
Path: Skills/exploit-dev/offensive-toctou/SKILL.md
Commit: 24d7968

Reviewed: ~4 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.