Guide · Agent skill
How to use the Race Condition Testing Checklist agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Race Condition Testing Checklist is an agent skill, a folder of instructions that an AI assistant loads so it can follow a specific method. This guide explains what the offensive-race-condition skill makes the agent do, how to install it, how to trigger it, and what to watch for. It is written for people who already have authorisation to test the web application in question.
Race Condition Testing ChecklistSnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download the ZIP. Get the offensive-race-condition ZIP from the directory page. It contains SKILL.md.
- 2Unzip into the skills folder. Place the folder in ~/.claude/skills/ for all projects, or in a project's .claude/skills/ folder for one project.
- 3Or upload in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 4Confirm you are authorised. State that you have permission to test the target before asking for any testing help.
- 5Ask for a specific feature. Name the feature, such as coupon redemption or withdrawals, and the trigger term you want, such as race condition or TOCTOU.
- 6Work through the checklist. Let the agent run baseline analysis, then detection, timing and proof of concept in order.
- 7Document the impact. Record reproducible steps and the business impact the agent helps you assess.
What the skill makes the agent do
A race condition happens when two or more requests reach the same resource at nearly the same time and the application does not handle that overlap correctly. Typical examples are a single-use coupon redeemed several times, or a balance checked and debited in a way that lets withdrawals exceed the funds available.
Once installed, the skill gives the agent a structured checklist. It asks the agent to identify features prone to race conditions, such as financial transactions, coupon and points systems, registration, voting and rate-limited actions. It then helps plan simultaneous requests, check whether the attack succeeded, and consider the impact of anything found.
- Identify risky features in the target application and copy the corresponding requests
- Plan multiple requests that should be allowed once but not allowed several times
- Check results and repeat the attempt to improve the chance of success
- Assess the impact and suggest next steps
Install the skill from the download
Download the ZIP for Skills/web/offensive-race-condition from the directory page. The skill is a single file, SKILL.md, so the folder you unzip must contain that file.
For Claude Code, unzip the folder into ~/.claude/skills/ to make it available everywhere, or into a project's .claude/skills/ folder to limit it to that project.
In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload
Trigger the skill with natural requests
You do not need a special command. The skill loads when your conversation involves its trigger terms, which include race condition, TOCTOU, timing attack, Turbo Intruder, last-byte sync, rate limit bypass, double spend, concurrent request, race window, and time of check or time of use.
Name the target and the feature you want to test, and state that you are authorised to test it. Plain requests work well.
- "I'm authorised to test our staging store. Walk me through race condition checks on the coupon redemption endpoint."
- "Help me plan simultaneous requests to test whether a withdrawal can be made twice."
- "Which checklist items should I work through for a TOCTOU bug on the registration form?"
Understand the testing methodology
The skill asks the agent to work in order unless you say otherwise: first a baseline analysis of normal transaction flow, then detection by sending identical requests at the same time (the skill suggests 10 to 100 threads), then timing manipulation with varying delays, and finally a reproducible proof of concept with documented impact.
The skill also covers advanced techniques: API-based parallel requests, multi-step transactions where only the final step is sent in parallel, and thread synchronisation that releases waiting threads together. It mentions Burp Suite Turbo Intruder or Repeater, the Last-Byte sync technique, and network proximity to the target as ways to improve timing.
- Baseline: identify state-changing operations and the normal flow
- Detection: send identical requests simultaneously and observe state
- Timing: identify windows and vary delays
- Proof of concept: make it reproducible and document impact
What you need before you start
The skill itself runs no scripts and makes no network calls. Everything it does happens through the agent's conversation with you, so the actual sending of requests is done by tools you run yourself.
Burp Suite (Turbo Intruder or Repeater) or similar HTTP tooling is referenced as optional. Python with the requests library is optional and only needed for the sample script. You also need authorised access to the target application.
- Authorised access to the target application (required)
- Burp Suite Turbo Intruder or Repeater, or similar HTTP tooling (optional)
- Python with the requests library for the sample script (optional)
Safety notes before you send traffic
The skill is written from an offensive, bug-bounty perspective. Sending concurrent traffic to systems you do not own or have written permission to test can be illegal and can cause real harm, including to third-party services. Only use it against applications you are authorised to assess.
The skill is a methodology checklist. It does not include vetted attack tooling, so treat any generated script as something to review before running it against a live system.
- Test only systems you own or have written authorisation to test
- Prefer staging or test accounts where possible
- Review every script before running it
import requests
import threading
def make_request():
requests.post('https://target.com/api/redeem',
json={'coupon_code': 'ONCE123'},
headers={'Authorization': 'Bearer token'})
threads = []
for _ in range(20):
t = threading.Thread(target=make_request)
threads.append(t)
t.start()
for t in threads:
t.join()What people use it for
- Planning a concurrency test of a coupon redemption endpoint on a staging store you are authorised to assess
- Checking whether a withdrawal or transfer can be executed twice before the balance updates
- Reviewing a registration form for duplicate-account race conditions during an authorised bug bounty engagement
- Learning how TOCTOU and read-modify-write bugs work so you can defend against them in your own code
Frequently asked questions
How do I install the offensive-race-condition skill?
Download the ZIP from the directory page and unzip it into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder. In the Claude apps, you can instead upload it under Settings → Capabilities → Skills.
Is the Race Condition Testing Checklist skill free?
The skill is listed under the MIT licence. Check the licence file in the source repository for the full terms before reusing it.
What do I need to use this skill?
You need authorised access to the target application. Burp Suite Turbo Intruder or Repeater, or similar HTTP tooling, is optional, and Python with the requests library is optional for the sample script.
Does the skill run scripts or send network traffic itself?
No. The skill is listed as not running scripts and not using the network. Any requests are sent by tools you run yourself.
Is this skill safe for beginners?
It is not a beginner-safe tool. It is a methodology checklist written for people who already test systems they are authorised to test, and it does not include vetted attack tooling. Learning the concepts first is a sensible start.
How is this different from using Burp Suite Turbo Intruder directly?
Turbo Intruder is a tool that sends the requests. This skill gives the agent a checklist for choosing features, planning simultaneous requests, and assessing impact. Many testers use both, with the skill guiding the method and the tool doing the sending.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a security professional, bug bounty hunter, developer or student who already has permission to test the web application in question and wants a structured race condition checklist. Pick something else if you need a self-contained testing tool or you are new to web security, since the skill is a methodology only and does not include vetted attack tooling.
Download the skill