# Rate Limiting Abuse Protection

> Implements rate limiting and abuse prevention with per-route policies, IP/user-based limits, sliding windows, safe error responses, and observability. Use when adding "rate limiting", "API protection", "abuse prevention", or "DDoS protection".

- **Type:** Skill
- **Install:** `agentstack add skill-patricio0312rev-skillset-rate-limiting-abuse-protection`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [patricio0312rev](https://agentstack.voostack.com/s/patricio0312rev)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [patricio0312rev](https://github.com/patricio0312rev)
- **Source:** https://github.com/patricio0312rev/skillset/tree/main/templates/backend/rate-limiting-abuse-protection

## Install

```sh
agentstack add skill-patricio0312rev-skillset-rate-limiting-abuse-protection
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Rate Limiting & Abuse Protection

Protect APIs from abuse with intelligent rate limiting.

## Rate Limit Strategies

**Fixed Window**: 100 requests per hour
**Sliding Window**: More accurate, prevents bursts
**Token Bucket**: Allow bursts up to limit
**Leaky Bucket**: Smooth request rate

## Implementation (Express)

```typescript
import rateLimit from "express-rate-limit";

// Global rate limit
const globalLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // 100 requests per window
  message: "Too many requests, please try again later",
  standardHeaders: true, // Return rate limit info in headers
  legacyHeaders: false,
});

// Stricter limit for auth endpoints
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5, // Only 5 attempts
  skipSuccessfulRequests: true, // Don't count successful logins
});

app.use("/api/", globalLimiter);
app.use("/api/auth/login", authLimiter);
```

## Redis-based Rate Limiting

```typescript
import Redis from "ioredis";

const redis = new Redis();

export const checkRateLimit = async (
  key: string,
  max: number,
  window: number
): Promise => {
  const now = Date.now();
  const windowStart = now - window;

  await redis
    .multi()
    .zremrangebyscore(key, 0, windowStart)
    .zadd(key, now, `${now}`)
    .zcard(key)
    .expire(key, Math.ceil(window / 1000))
    .exec();

  const count = await redis.zcard(key);

  return {
    allowed: count  {
  return async (req, res, next) => {
    if (!req.user) return next();

    const key = `rate_limit:user:${req.user.id}`;
    const result = await checkRateLimit(key, max, window);

    res.setHeader("X-RateLimit-Limit", max);
    res.setHeader("X-RateLimit-Remaining", result.remaining);

    if (!result.allowed) {
      return res.status(429).json({
        error: "Rate limit exceeded",
        retryAfter: window / 1000,
      });
    }

    next();
  };
};
```

## IP-based Protection

```typescript
// Block suspicious IPs
const ipBlocklist = new Set();

export const checkIPReputation = async (ip: string): Promise => {
  if (ipBlocklist.has(ip)) return false;

  // Check against threat intelligence API
  const reputation = await checkThreatIntel(ip);
  if (reputation.isMalicious) {
    ipBlocklist.add(ip);
    return false;
  }

  return true;
};
```

## Response Headers

```
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1640000000
Retry-After: 3600
```

## Best Practices

- Different limits for different endpoints
- Lower limits for expensive operations
- Skip rate limit for internal services
- Return helpful error messages
- Log rate limit violations
- Monitor for abuse patterns
- Allowlist trusted IPs

## Output Checklist

- [ ] Rate limiter middleware
- [ ] Per-route policies
- [ ] User-based limiting
- [ ] IP-based limiting
- [ ] Rate limit headers
- [ ] Safe error responses
- [ ] Observability/logging
- [ ] Bypass for internal services

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [patricio0312rev](https://github.com/patricio0312rev)
- **Source:** [patricio0312rev/skillset](https://github.com/patricio0312rev/skillset)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-patricio0312rev-skillset-rate-limiting-abuse-protection
- Seller: https://agentstack.voostack.com/s/patricio0312rev
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.