concurrency-security
TOCTOU prevention, distributed locking, idempotency keys, race condition detection for Node.js and serverless environments.
npx skills add vibeeval/vibecosystem --skill concurrency-security --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Concurrency Security Patterns for preventing race conditions, double-execution, and state corruption in concurrent systems. ## TOCTOU Prevention Time-of-Check to Time-of-Use: the gap between reading state and acting on it. ```typescript // WRONG: check then act - another process can change state between lines const balance = await db.accounts.findUnique({ where: { id } }) if (balance.amount >= amount) { await db.accounts.update({ where: { id }, data: { amount: balance.amount - amount } }) } // CORRECT: atomic check-and-update in a single statement const updated = await db.$executeRaw` UPDATE accounts SET amount = amount - ${amount} WHERE id = ${id} AND amount >= ${amount} RETURNING * ` if (updated.count === 0) throw new Error('Insufficient funds or concurrent update') ``` ```typescript // File system TOCTOU (Node.js) // WRONG if (fs.existsSync(filePath)) { fs.writeFileSync(filePath, data) // another process may have deleted it } // CORRECT: use O_EXCL flag for exclusive creation import { open } from 'fs/promises' try { const fh = await open(filePath, 'wx') // fail if file exists await fh.writeFile(data) await fh.close() } catch (err: any) { if (err.code === 'EEXIST') { /* already
- TOCTOU Prevention
- Distributed Locking with Redis
- Redlock Algorithm (multi-node)
- PostgreSQL Advisory Locks
- Idempotency Key Implementation
- Atomic Database Operations
- Double-Submit Prevention
- Optimistic vs Pessimistic Concurrency Control
- Serverless Cold Start Race Conditions
- Testing for Race Conditions
What does the concurrency-security skill do?
TOCTOU prevention, distributed locking, idempotency keys, race condition detection for Node.js and serverless environments.
How do I install it?
Run `npx skills add vibeeval/vibecosystem --skill concurrency-security --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From vibeeval/vibecosystem, a repository with 521 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.