Rate Limiting and Abuse Review skill for Claude and Codex

Rate Limiting and Abuse Review as an AI skill. It asks for API description, Who calls it, Authentication and 3 more, then does the rest. Free to install in…

Install it once and Claude or Codex runs it for you. When your request matches, your AI loads the skill, asks for anything it is missing, and works through the template itself. Prefer to fill it in by hand? See the full prompt template.

Download the skill (.zip) · View SKILL.md

When it is used

Use when an API needs a review for abuse paths such as scraping, credential stuffing or cost attacks, with rate limits and quotas proposed. Do not use for a general security audit or penetration test. Related topics: coding, technical.

What it will ask you for

• API description (longer free text)
• Who calls it (choose any: Browser users, Mobile apps, Partner servers, Public developers, Internal services)
• Authentication (choose one: None, API key, User session, OAuth)
• Costly operations (longer free text)
• Current protections (longer free text)
• Infrastructure (free text, e.g. "Cloud Run behind a CDN or similar")

How it works

1. Rank the endpoints by potential damage across cost, data exposure and availability.
2. Assign each risky endpoint a limit keyed by caller identity with a number, a window and an algorithm.
3. Set stricter limits for login, reset, signup and message-sending paths, and a plan for unauthenticated traffic.
4. Specify the 429 response, the Retry-After header and the client backoff with jitter.
5. Add quotas, size caps, pagination caps and idempotency rules, and say where each limit lives and what to alert on.

What you get

A ranked endpoint risk table, a limits table with key, number, window and algorithm, the error response format, client backoff guidance and an alerting list.

What it watches out for

• Limiting by IP alone, which blocks shared offices and mobile carriers while a botnet walks through.
• Applying one global limit, so cheap reads and expensive writes share the same ceiling.
• Returning different errors for unknown and wrong passwords, which lets attackers enumerate accounts despite the limit.

How to install

Claude.ai and the Claude desktop app

1. Download the skill .zip.
2. Open Settings, then Capabilities, and find Skills.
3. Choose Upload skill and select the .zip.
4. Ask Claude for help with the task. It loads the skill when your request matches.

Claude Code

1. Download the skill .zip.
2. Unzip it into ~/.claude/skills/ (or .claude/skills/ inside a project).
3. Start a new session. Claude Code loads the skill when your request matches.

Codex

1. Download the skill .zip.
2. Unzip it into ~/.agents/skills/ (or .agents/skills/ inside a project).
3. Codex picks it up on its own. Type $ and the skill name to use it, or just ask for the task.

Cursor

1. Download the Cursor rule (.mdc).
2. Save it in .cursor/rules/ inside your project.
3. Cursor's agent applies the rule when your request matches its description.

AGENTS.md (Codex, Cursor, and other coding agents)

1. Copy the AGENTS.md section.
2. Paste it into AGENTS.md at the root of your repository, creating the file if needed.
3. Coding agents that read AGENTS.md follow it when your request fits.