360 Secure SkillHub
360 安全技能中心

Rate Limit Validator

运行 Bash 脚本向指定 HTTP 端点发送一批 GET 请求，统计 200 与 429 响应数量，并检查 Retry-After、X-RateLimit 响应头是否存在，用于部署前验证网关或 API 的限流是否生效。

techris93
techris93
热度 84.94
最近更新 2026-05-17 13:14:02
分类：安全依赖：代码执行 / 读写文件 / 第三方 API应用场景：DevOps / API 集成 / 自动化脚本

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add rate-limit-validator
Metadata
name
rate-limit-validator
description
Test whether an HTTP endpoint enforces rate limiting. Sends a burst of requests and checks for 429 responses, Retry-After, and X-RateLimit headers. Useful for validating gateway and API throttling before going to production.
metadata
{"openclaw":{"requires":{"bins":["curl"]}}}

Rate Limit Validator

Tests whether an HTTP endpoint actually enforces rate limiting.

Most rate-limit skills help you add rate limiting. This one helps you check if it's working — or if it's missing entirely.

What it checks

  • Whether the server returns HTTP 429 under burst load
  • Presence of Retry-After header
  • Presence of X-RateLimit-Limit and X-RateLimit-Remaining headers
  • Response time degradation under sustained requests

When to use it

  • Before deploying an API or gateway to production
  • After adding rate-limit middleware, to confirm it works
  • When auditing a third-party service you depend on
  • Validating threat model mitigations (e.g. T-IMPACT-002)

Example prompts

  • "Test if my gateway has rate limiting"
  • "Validate rate limiting on http://localhost:18789"
  • "Check if my API throttles requests"

Test script

#!/bin/bash
TARGET="${1:-http://localhost:18789/}"
COUNT="${2:-50}"
TMP="/tmp/ratelimit-test-$$.txt"

echo "Target: $TARGET"
echo "Requests: $COUNT"
echo ""

for i in $(seq 1 $COUNT); do
  curl -s -o /dev/null -w "%{http_code}" "$TARGET" >> "$TMP"
  echo "" >> "$TMP"
done

TOTAL_200=$(grep -c '200' "$TMP" || echo 0)
TOTAL_429=$(grep -c '429' "$TMP" || echo 0)

echo "Allowed (200): $TOTAL_200"
echo "Throttled (429): $TOTAL_429"
echo ""

HEADERS=$(curl -sI "$TARGET")
echo "$HEADERS" | grep -qi "retry-after" && echo "Retry-After: present" || echo "Retry-After: missing"
echo "$HEADERS" | grep -qi "x-ratelimit" && echo "X-RateLimit: present" || echo "X-RateLimit: missing"

echo ""
if [ "$TOTAL_429" -gt 0 ]; then
  echo "Result: rate limiting is active ($TOTAL_429/$COUNT throttled)"
else
  echo "Result: no rate limiting detected ($TOTAL_200/$COUNT allowed through)"
fi

rm -f "$TMP"

Notes

  • Only sends GET requests, no payloads
  • Meant for testing your own deployments, not for attacking others
  • In OpenClaw's trust model, rate limiting is a hardening measure, not a security boundary (authenticated callers are trusted operators)

References