Rate Limit Validator

---

name: rate-limit-validator description: > Test whether an HTTP endpoint enforces rate limiting. Sends a burst of requests and checks for 429 responses, Retry-After, and X-RateLimit headers. Useful for validating gateway and API throttling before going to production. metadata: openclaw: requires: bins: - curl

---

Rate Limit Validator

Tests whether an HTTP endpoint actually enforces rate limiting.

Most rate-limit skills help you *add* rate limiting. This one helps you *check* if it's working — or if it's missing entirely.

What it checks

Whether the server returns HTTP 429 under burst load

Presence of Retry-After header

Presence of X-RateLimit-Limit and X-RateLimit-Remaining headers

Response time degradation under sustained requests

When to use it

Before deploying an API or gateway to production

After adding rate-limit middleware, to confirm it works

When auditing a third-party service you depend on

Validating threat model mitigations (e.g. T-IMPACT-002)

Example prompts

"Test if my gateway has rate limiting"

"Validate rate limiting on http://localhost:18789"

"Check if my API throttles requests"

Test script

#!/bin/bash
TARGET="${1:-http://localhost:18789/}"
COUNT="${2:-50}"
TMP="/tmp/ratelimit-test-$$.txt"
echo "Target: $TARGET"
echo "Requests: $COUNT"
echo ""
for i in $(seq 1 $COUNT); do
  curl -s -o /dev/null -w "%{http_code}" "$TARGET" >> "$TMP"
  echo "" >> "$TMP"
done
TOTAL_200=$(grep -c '200' "$TMP" || echo 0)
TOTAL_429=$(grep -c '429' "$TMP" || echo 0)
echo "Allowed (200): $TOTAL_200"
echo "Throttled (429): $TOTAL_429"
echo ""
HEADERS=$(curl -sI "$TARGET")
echo "$HEADERS" | grep -qi "retry-after" && echo "Retry-After: present" || echo "Retry-After: missing"
echo "$HEADERS" | grep -qi "x-ratelimit" && echo "X-RateLimit: present" || echo "X-RateLimit: missing"
echo ""
if [ "$TOTAL_429" -gt 0 ]; then
  echo "Result: rate limiting is active ($TOTAL_429/$COUNT throttled)"
else
  echo "Result: no rate limiting detected ($TOTAL_200/$COUNT allowed through)"
fi
rm -f "$TMP"

Notes

Only sends GET requests, no payloads

Meant for testing your own deployments, not for attacking others

In OpenClaw's trust model, rate limiting is a hardening measure,

not a security boundary (authenticated callers are trusted operators)

References

OpenClaw threat model (T-IMPACT-002)

OpenClaw security policy

Only sends GET requests, no payloads

Meant for testing your own deployments, not for attacking others

In OpenClaw's trust model, rate limiting is a hardening measure,

not a security boundary (authenticated callers are trusted operators)