race-condition-exploit

该技能与其宣称目的基本一致，但其目的本身就是教 AI 代理实施竞态漏洞利用、限流绕过、token 重用、双花和 webshell 竞态访问，属于高风险 offensive security 技能。未见明显凭证回传到攻击者控制域名或隐藏式窃密，因此不足以定性为确认恶意软件；但禁用 TLS 校验、面向真实利用的脚本和对认证材料的直接使用，使其整体应归为高风险、可被滥用的可疑技能。

The fragment is an explicit race-condition testing and exploitation utility. It sends synchronized authenticated requests and could abuse redemption, transfer, purchase-limit, upload, or voting endpoints if used against systems without authorization. It does not show covert exfiltration, backdoors, credential harvesting, obfuscation, or other conventional malware behavior. Treat as security-sensitive offensive tooling and use only in an authorized test environment.

The fragment is an offensive race-condition testing/exploitation toolkit and documentation. It can generate synchronized or concurrent requests that abuse checkout, voting, password-reset, coupon, inventory, and withdrawal workflows. It does not show conventional package malware such as system-data theft, persistence, command execution, or cryptomining, but it presents substantial dual-use security risk, especially because it uses target sessions or bearer tokens and disables TLS verification in one example.

This code fragment is a clearly malicious exploit script: it performs concurrent authenticated abuse of transfer/redeem APIs using race-condition techniques, uploads a PHP webshell that executes OS commands, and then retrieves and prints sensitive data from the target. If such a snippet appeared in an open-source package, it would represent an extreme supply-chain security risk.