How to use the Race Condition State Drift agent skill

What does this skill make the agent do?

The skill covers bugs where the order or timing of simultaneous requests changes the outcome. Examples named in the source include race windows, idempotency failures, lock gaps, concurrent worker drift, stale reads, and privilege or balance drift caused by request ordering.

When the skill is active, the agent is guided to map the mutable state (rows, cache keys, queue payloads, session fields, counters or files), build a small concurrent test, capture a baseline run and a racing run that differ by one variable, and record the read, check, write, enqueue and commit boundaries separately.

• Identify the mutable state first.
• Reproduce with the smallest concurrent sequence and fixed timing assumptions.
• Compare one baseline run with one racing run.
• Prove the final state drift from a clean reset.

Install the skill from a ZIP file

Download the ZIP file from this page and unzip it into one of two locations. Use ~/.claude/skills/ for a personal install available to all your projects, or use the .claude/skills/ folder inside a specific project if you want it limited to that project.

If you use the Claude apps instead, you can upload the ZIP under Settings, then Capabilities, then Skills.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Install the parent skill first

This skill is designed to be used only after $ctf-sandbox-orchestrator is already active and has set up sandbox assumptions, node ownership and evidence priorities. The skill itself says that if this has not happened, the agent should return to $ctf-sandbox-orchestrator first.

Without the parent skill, this skill is out of place on its own. Make sure your sandbox target environment is set up by you, because these files do not provide one.

How do you trigger the skill with a natural request?

You do not need special syntax. The skill is meant to activate when you ask for help reproducing timing-sensitive or ordering-dependent behaviour. The source lists these trigger themes: timing-sensitive bugs, concurrent state corruption, duplicate actions, stale reads, and privilege or balance drift caused by request ordering.

Say what the system does, what should happen, and that the test runs in your lab. Mention the parent workflow so the agent routes correctly.

• Using ctf-sandbox-orchestrator, reproduce a double-spend race on the balance endpoint in my lab sandbox.
• Two identical checkout requests sometimes both succeed. Build a minimal concurrent test to show why.
• Our CTF challenge seems to return a stale session role after a privilege change. Help me capture a baseline and a racing run.
• Show me a replayable request sequence that proves the duplicate submission bug in my test environment.

What the agent produces

The source asks the agent to keep evidence together so the result can be checked. For each finding this includes the state side (key or row, initial value, final value, commit boundaries), the timing side (request order, delays, retries, queue timing) and the effect side (duplicated action, privilege drift, balance drift or stale authorisation).

The agent should reduce the finding to a short chain: request A and B ordering, then a stale check or lock gap, then conflicting writes, then the resulting capability or artifact. It should also say whether the root cause is a missing lock, weak idempotency, a stale cache read, a delayed async commit, or a retry side effect.

• Mutable keys, transaction boundaries, lock behaviour and idempotency markers
• Timestamped or sequenced traces for baseline and race runs
• One minimal replayable concurrent sequence that proves the drift

Safety, scripts and network use

Use this skill only on systems you own or are explicitly allowed to test, such as a CTF lab or a test environment you control. The source describes the skill as aimed at reproducing exploitable bugs, and it describes no authorisation check, so the responsibility for scope sits with you.

According to the source, the skill runs no scripts and uses no network access. The source also says the agent should reply in Simplified Chinese unless you explicitly ask for English. It does not cover general performance or load testing.

• Do not point it at live or production systems you do not own.
• Scripts: none listed.
• Network: none listed.
• Default reply language: Simplified Chinese unless you request English.

Tips for better results

The source warns about two common mistakes. The first is running noisy stress tests without a minimal deterministic sequence. The second is mixing several mutable keys without proving which one drives the effect. Start small and change one thing at a time.

A timing bug is only proven when the final state differs from a clean reset in a way you can show. Reporting timing sensitivity alone is not enough.

• Start with a single pair of requests before scaling up.
• Reset the sandbox to a clean state before each comparison.
• Track one mutable key at a time until you know which one drives the effect.
• If the problem turns out to be dominated by a queue, the source says to hand off to a queue worker drift skill.