Skip to content
Get packs

Race Condition State Drift

Guides an agent to reproduce timing and concurrency bugs in a CTF sandbox.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This skill is a specialist add-on for an existing CTF (capture-the-flag) sandbox workflow. When active, it tells the agent how to investigate bugs where the order or timing of simultaneous requests causes problems, such as duplicate actions, stale reads, lock gaps, or balance and privilege drift. The agent is guided to map the mutable state, build a small concurrent test, compare a baseline run with a racing run, and document a minimal replayable sequence that proves the bug. It is written to be used only after a parent skill, ctf-sandbox-orchestrator, has set up sandbox assumptions.

Great for

  • Security students practising race-condition challenges in a CTF lab
  • Developers reproducing timing-sensitive bugs such as double spending or duplicate submissions in a test environment
  • Security reviewers who already use the ctf-sandbox-orchestrator workflow

Skip it if

  • Testing live or production systems the user does not own, since the skill is aimed at reproducing exploitable bugs and no authorisation check is described in the files
  • Users who have not installed or activated ctf-sandbox-orchestrator, because the skill says it should return to that parent skill first and will be out of place on its own
  • General performance or load testing, which the skill does not cover

Try asking

  • “Reproduce a double-spend bug in our sandboxed wallet service when two withdrawal requests arrive at the same time”
  • “Find out why duplicate orders appear in the CTF target when the checkout request is retried”
  • “Build a minimal concurrent sequence showing a stale cache read that grants admin rights”
Step-by-step guide: how to use Race Condition State DriftInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-race-condition-state-drift.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-race-condition-state-drift.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-race-condition-state-drift.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run it only inside an isolated CTF or lab environment you are authorised to test, and load the parent skill first.
  • Give the agent the exact endpoints, state stores, and timestamps you have, so it can build a precise concurrent sequence.
  • Ask for the reply in English if you prefer, since the skill defaults to Simplified Chinese.

What's inside

  • agents/openai.yaml
  • references/race-condition-state-drift.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.