# File Time-of-Check / Time-of-Use (TOCTOU)

> Detects file operations that check file properties before using them, creating a race window exploitable via symlink attacks.

- Skill: `zakirkun/file-time-of-check-time-of-use-toctou` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/file-time-of-check-time-of-use-toctou`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/file-time-of-check-time-of-use-toctou/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/file-time-of-check-time-of-use-toctou

---


# File TOCTOU Race Condition

## Overview
TOCTOU (Time-of-Check/Time-of-Use) vulnerabilities occur when there is a window between checking a file's state and using it. An attacker can replace the file with a symlink between the check and the use, potentially reading/writing arbitrary files.

Classic pattern: `if access(path, R_OK) == 0: open(path)` — between access() and open(), attacker creates symlink.

## Remediation
- Use `O_NOFOLLOW` flag to prevent symlink following
- Use `openat()` with AT_FDCWD to operate atomically
- In Python, use `os.open()` with `os.O_NOFOLLOW`
- Validate path within a trusted directory after opening