hellodqy/mastermind-bug-bounty/race-condition
Claude Code and agent skill by hellodqy/mastermind-bug-bounty
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Identify business actions where concurrent execution can multiply value or bypass limits.
Install
npx vskill@latest install hellodqy/mastermind-bug-bounty/race-conditionSKILL.md
Race Condition
Goal
判断某个业务动作是否因并发导致重复领取、重复消费、余额/库存/权限状态错乱。
Tools / Inputs
- 测试账号、优惠券/积分/订单/提现/库存/签到接口
- 资源索引：
references/INDEX.md；候选资源：race-condition-testing.md；需要通用业务分类时再读bug_classes.md
Constraints
- 只用测试账号和可回滚/无害业务对象。
- 不对真实资金、真实库存、真实用户造成影响。
- 先证明单次正常行为，再比较并发差异。
- 成功必须量化多拿了什么或绕过了什么限制。
- 新状态或凭据变化继续回注攻击面。
Chain Questions
- 这个动作是否有“只能一次”的业务语义？
- 并发前后余额、库存、权益、状态是否不一致？
- 竞态结果能不能解锁更高权限或二次利用？
- 是否已经足够证明经济/权限影响？
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/race_condition/SKILL.md
Popularity
- 7-day trend score
- 5
Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/race-condition)