Why is it important to detect TOCTOU in PHP?

TOCTOU vulnerabilities can allow attackers to manipulate files or data between the time a check is performed and the time it is used, leading to security breaches or data loss.

What types of race conditions can this skill detect?

This skill detects TOCTOU (Time-of-Check to Time-of-Use), shared mutable state, non-atomic increments, and database or file system concurrency issues.

Can it identify database-specific concurrency issues?

Yes, it flags unique constraint races and scenarios where an entity is modified without proper locking or versioning.

Does it provide fixes for detected race conditions?

Yes, it suggests specific thread-safe alternatives such as atomic Redis operations, SQL updates with conditions, and pessimistic or optimistic locking.

PHP Race Condition Detector

Name: PHP Race Condition Detector
Author: dykyi-roman

bydykyi-roman

•

Security & Testing

Identifies and resolves concurrency issues, shared mutable states, and TOCTOU vulnerabilities in PHP applications.

The PHP Race Condition Detector is a specialized Claude Code skill designed to audit your codebase for subtle concurrency bugs that lead to data corruption or security risks. It automatically scans for patterns like check-then-act (TOCTOU), non-atomic increments, and unsafe shared mutable state in files, sessions, and databases. By providing immediate severity classifications and suggesting thread-safe fixes—such as pessimistic locking, optimistic locking, or atomic operations—it helps developers build more resilient, production-grade PHP applications within complex architectures like DDD and Clean Architecture.

Key Features

01Identifies unsafe shared mutable state and non-atomic read-modify-write patterns

02Analyzes Redis and session-based race conditions that cause lost updates

03Offers actionable code refactoring suggestions using atomic operations and locking mechanisms

04Provides severity classifications ranging from Minor cache issues to Critical financial data risks

0545 GitHub stars

06Detects Time-of-Check to Time-of-Use (TOCTOU) vulnerabilities in file and database operations

Use Cases

01Auditing financial transaction logic to prevent balance inconsistencies

02Securing file system operations against concurrent access in multi-process environments

03Preventing inventory overselling in high-traffic e-commerce systems

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add dykyi-roman/awesome-claude-code find-race-conditions

For use in Claude.ai and ChatGPT

Download Skill