Skip to content
Get packs

Race Condition Testing Checklist

Guides an agent through testing web apps for race condition and TOCTOU bugs, including parallel-request attack techniques

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

This skill gives an AI assistant a structured checklist for finding race condition bugs in web applications, where two or more requests hit the same resource at nearly the same time and break rules like single-use coupons or balance checks. Once installed, the agent walks through identifying risky features (payments, coupons, rate limits, registration), planning simultaneous requests, and suggesting follow-up steps and impact assessment. It is written from an offensive, bug-bounty perspective, so it is aimed at people who already test systems they are authorised to test.

Great for

  • Security professionals and bug bounty hunters testing web applications they have permission to assess
  • Developers or QA engineers who want to understand race conditions well enough to defend against them
  • Students learning web application security concepts

Skip it if

  • Testing systems you do not own or have written authorisation to test, because sending concurrent attack traffic to third-party services can be illegal and cause real harm
  • Beginners looking for a safe, self-contained tool: the skill is a methodology checklist and does not itself include vetted attack tooling

Try asking

  • “Review this checkout flow for race conditions where a coupon could be redeemed twice, using the authorised test scope I describe”
  • “Give me a checklist for testing our rate limit on password reset for last-byte sync or parallel request weaknesses”
  • “Help me plan a double-spend test on our staging wallet API and explain what results would confirm a bug”
Step-by-step guide: how to use Race Condition Testing ChecklistInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-race-condition.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-race-condition.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-race-condition.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • State your authorised scope and test environment (for example a staging server you own) at the start so the agent keeps its suggestions within bounds
  • Ask the agent to explain each technique's expected evidence so you can document findings clearly for a report
  • Run concurrent tests against non-production copies where possible to avoid data corruption or denial of service

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.