# A04 Insecure Design > Skills for exploiting insecure design patterns including race conditions and parameter pollution per OWASP A04:2021. Use when this capability is needed. - Skill: `tomevault-io/a04-insecure-design` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/a04-insecure-design` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/a04-insecure-design/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/a04-insecure-design --- # Insecure Design (OWASP A04) Flaws in design and architecture that cannot be fixed by proper implementation. ## Skills - [Race Condition](references/race-condition.md) - Timing-based exploitation - [Parameter Pollution](references/parameter-pollution.md) - HTTP parameter manipulation ## Quick Reference | Attack | Target | Technique | |--------|--------|-----------| | Race Condition | Financial, limits | Parallel requests | | HPP | WAF bypass, logic | Duplicate parameters | --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/omkar-ukirde) — claim your Tome and manage your conversions.