CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

api-rate-limiting

Implements API rate limiting using token bucket, sliding window, and Redis-based algorithms to protect against abuse. Use when securing public APIs, implementing tiered access, or preventing denial-of-service attacks.

70

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, code-forward reference that respects the token budget and gives executable examples for the core token-bucket case. The main weaknesses are coverage gaps (sliding window and Redis named but never shown), no explicit algorithm-selection or validation workflow, and minor structural room for a references file for distributed setups.

Suggestions

Add short, complete implementations (or a concrete Redis recipe, e.g., with a named library) for sliding window and Redis-based limiting, since both are promised in the description but never shown.

Include a one-line decision rule for choosing between the custom TokenBucket class and express-rate-limit middleware, and turn "Test under load" into a concrete verification command or step.

Move the distributed/Redis material into a references/ file (one level deep) if more than a few lines are needed, keeping SKILL.md as a lean overview with a clearly signaled link.

DimensionReasoningScore

Conciseness

The body is lean: a pros/cons table, one executable class, one middleware config, a header block, a tier table, and short bullet lists. It never explains concepts Claude already knows (e.g., what rate limiting is), so every token earns its place.

5 / 5

Actionability

The TokenBucket class and Express middleware are concrete and executable, but the sliding-window and Redis-based algorithms promised in the description receive no implementation, and the "Best Practices" bullets ("Monitor rate limit metrics", "Test under load") are abstract direction rather than instructive content. It is above 3 because the provided code is real and complete, not pseudocode.

4 / 5

Workflow Clarity

The sections guide a reader from algorithm comparison to implementation to response headers, but there is no explicit sequence (e.g., when to use the custom class vs express-rate-limit, or how to wire Redis in for distributed limiting) and validation appears only as the bare bullet "Test under load" rather than a checkpoint. It is above 3 because the organization still makes the path reasonably unambiguous.

4 / 5

Progressive Disclosure

A self-contained single file with well-organized sections and no nested references, which navigates cleanly. It falls short of 5 only because the body is slightly beyond the ~50-line simple-skill range and topics like Redis distributed limiting are mentioned without a reference file or detail, leaving a minor organizational gap.

4 / 5

Total

17

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that explicitly covers both what the skill does and when to use it, with concrete algorithm names and natural trigger phrases. The only gaps are a few missing synonyms ("throttling", "429") and mild overlap risk with general API-security skills.

DimensionReasoningScore

Specificity

"Implements API rate limiting using token bucket, sliding window, and Redis-based algorithms to protect against abuse" names the domain and multiple concrete approaches with comprehensive coverage. It is not below 5 because no capability area of the skill is left to inference.

5 / 5

Completeness

Both questions are answered explicitly: what ("Implements API rate limiting using token bucket, sliding window, and Redis-based algorithms") and when ("Use when securing public APIs, implementing tiered access, or preventing denial-of-service attacks"). This matches the 5 anchor exactly, so no lower anchor fits.

5 / 5

Trigger Term Quality

"securing public APIs, implementing tiered access, or preventing denial-of-service attacks" provides good natural trigger coverage, but common user phrases like "throttling", "API limits", or "429 errors" are missing. It exceeds 3 because multiple relevant natural terms are present, not just a few keywords.

4 / 5

Distinctiveness Conflict Risk

"API rate limiting" with named algorithms carves a clear niche, but the trigger "securing public APIs" overlaps with general API-security and authentication skills. It is above 3 because the core trigger (rate limiting) is distinct and unlikely to fire for unrelated skills.

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

secondsky/claude-skills

Path

plugins/api-rate-limiting/skills/api-rate-limiting/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.