from security-skill19
Send concurrent request bursts to detect TOCTOU, coupon reuse, double-spend and other web endpoint race conditions.
This skill provides a practical workflow for testing web endpoints for race-condition vulnerabilities by launching controlled concurrent requests against stateful operations (coupon redemption, balance debit, order placement, OTP verification). It walks the agent through identifying likely targets, crafting request payloads, executing synchronized bursts (using curl + GNU parallel), and analysing response patterns and server-side state to determine if multiple requests were erroneously accepted.
Use this skill during security assessments, bug-bounty triage, or QA when you suspect non-atomic operations: promo code redemption, gift-credit spending, inventory decrement on purchase, OTP/token verification, or rate-limited sensitive actions. It helps confirm TOCTOU, double-spend, and limit-overrun weaknesses.
Best for agents that can run shell commands or provide guidance for pentesting workflows (agents with bash/CLI tooling, security-focused assistants).
This skill has not been reviewed by our automated audit pipeline yet.
