CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

rate-limiting-apis

Implement sophisticated rate limiting with sliding windows, token buckets, and quotas. Use when protecting APIs from excessive requests. Trigger with phrases like "add rate limiting", "limit API requests", or "implement rate limits".

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Well-structured, actionable content with a clear build sequence and a genuine validation step. The main weakness is uneven reference quality: examples.md delivers full executable code, while implementation.md and errors.md contain mostly generic API material that does not fulfill what the body's links promise.

Suggestions

Rewrite references/implementation.md as an actual rate-limiting implementation guide (algorithm selection details, Redis store setup, middleware wiring) so it delivers the "full implementation guide" the body advertises, and align references/errors.md with the rate-limiting error table rather than generic API errors.

Include one compact executable snippet in the body itself (e.g., the Redis Lua atomic increment-and-check or the sorted-set sliding-window command sequence) so core guidance is executable without opening references.

Either attach URLs to "Token bucket algorithm explained" and "Redis rate limiting patterns with Lua scripts" in Resources or remove them; unlinked titles add tokens without navigational value.

DimensionReasoningScore

Conciseness

The body is dense and directive ("Free (100 req/min), Pro (1000 req/min), Enterprise (10000 req/min)", "allow 2x the sustained rate for 10 seconds") with no explanation of concepts Claude already knows; not 5 because the two unlinked Resources entries ("Token bucket algorithm explained", "Redis rate limiting patterns with Lua scripts") and parts of Prerequisites add tokens without earning their place; not 3 because the padding is minor rather than "some unnecessary explanation".

4 / 5

Actionability

Concrete, specific guidance throughout: exact header names ("X-RateLimit-Limit", "X-RateLimit-Remaining", "X-RateLimit-Reset", "RateLimit-Policy"), exact status semantics ("Return 429 Too Many Requests with Retry-After header"), exact tier numbers, and concrete output paths; not 5 because the body itself contains no executable code or commands — the executable code lives entirely in references/examples.md; not 3 because the guidance is specific and complete enough to execute directly, well above pseudocode level.

4 / 5

Workflow Clarity

Nine numbered steps in a coherent build order (analyze traffic, select algorithm, implement middleware, configure tiers, add burst, set headers, return 429, bypass, tests) ending in an explicit validation step ("Write tests that verify rate limits engage at exact thresholds, headers reflect correct remaining counts, and limits reset at the configured window boundary"); not 5 because there is no explicit validate-and-fix feedback loop during implementation, only a terminal test step; not 3 because validation is present and the sequence has no gaps. This is middleware implementation, not a destructive or batch operation, so the workflow-clarity cap does not apply.

4 / 5

Progressive Disclosure

The body is a lean overview with well-signaled, one-level-deep references that all exist as real files (references/implementation.md, references/errors.md, references/examples.md) and no nested references inside them; not 5 because references/implementation.md, billed as "the full implementation guide", actually contains generic API-design steps (scaffolding, CORS, OpenAPI docs) rather than rate-limiting implementation, so navigation leads partially astray — errors.md is likewise mostly generic API errors with only one rate-limit entry; not 3 because the structure itself (split, signaling, depth) is sound.

4 / 5

Total

16

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that clearly states what the skill does, when to use it, and which phrases trigger it. The only gaps are a missing common synonym ("throttling") in the trigger list and minor coverage omissions (rate limit headers, 429 responses) in the capability statement.

DimensionReasoningScore

Specificity

"Implement sophisticated rate limiting with sliding windows, token buckets, and quotas" names the domain plus three concrete techniques, matching the anchor for several specific capabilities with minor gaps; not 5 because it omits capabilities the skill covers (response headers, 429/Retry-After handling, tiered quotas per plan) and "sophisticated" is mild buzzword padding; not 3 because it is noticeably more concrete than the "1-2 concrete actions" anchor.

4 / 5

Completeness

Explicitly answers what ("Implement sophisticated rate limiting with sliding windows, token buckets, and quotas") and when ("Use when protecting APIs from excessive requests") plus concrete trigger phrases ("Trigger with phrases like 'add rate limiting', 'limit API requests', or 'implement rate limits'"), matching the top anchor exactly; not 4 because the 'when' is fully explicit with enumerated trigger phrases rather than merely present.

5 / 5

Trigger Term Quality

"add rate limiting", "limit API requests", and "implement rate limits" are natural phrases a user would actually say, giving good keyword coverage; not 5 because common synonyms and variants like "throttle/throttling", "too many requests", or "429" are absent; not 3 because the description goes beyond "some relevant keywords" with multiple explicit natural phrasings.

4 / 5

Distinctiveness Conflict Risk

API rate limiting is a clear niche and the triggers ("add rate limiting", "limit API requests") are distinct, with minimal overlap risk against general API-building, caching, or auth skills; not 4 because no closely related skill would plausibly capture these triggers.

5 / 5

Total

18

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

allowed_tools_field

'allowed-tools' contains unusual tool name(s)

Warning

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

14

/

16

Passed

Repository

jeremylongshore/tons-of-skills-marketplace

Path

plugins/api-development/api-rate-limiter/skills/rate-limiting-apis/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.