exploiting-race-condition-vulnerabilities

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes hard-coded sensitive values (e.g., "Cookie: session=VALID_SESSION" and SESSION_COOKIE = "session=abc123") and instructs generating requests/scripts that embed those secrets verbatim, which requires the LLM to handle/output secret values directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, actionable exploit techniques and scripts for abusing race-condition vulnerabilities (coupon double-spend, balance overdraft, MFA bypass, and an account takeover example changing email to attacker@evil.com plus triggering password reset) that enable unauthorized financial theft and account compromise, representing high-risk malicious guidance despite a legal notice.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly focused on exploiting race conditions in state-changing, transaction-based operations and includes concrete examples and scripts targeting financial actions: coupon redemption, "Account balance transfers", a POST /transfer example with "Overdraft achieved", and workflows to perform concurrent redemption/transfer requests. Those examples and scripts are designed to cause unauthorized or duplicated financial effects (double-spend/overdraft) by sending simultaneous transaction requests. This constitutes direct financial execution capability (sending/forcing transaction requests that move or alter monetary balances), not merely generic automation.