Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/pierry/harness-kit/rate-limiternpx skills add Pierry/harness-kit --skill rate-limitergit clone --depth 1 https://github.com/Pierry/harness-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pierry/harness-kit/rate-limiter)<a href="https://agentmods.dev/skills/pierry/harness-kit/rate-limiter"><img src="https://agentmods.dev/badge/skills/pierry/harness-kit/rate-limiter.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00059 | $0.01924 |
| Opus 5 | $0.00030 | $0.00962 |
| Sonnet 5 | $0.00012 | $0.00385 |
| Haiku 4.5 | $0.00006 | $0.00192 |
Grade A, and why
rate-limiter scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 155 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Design a distributed rate limiter. Topic playbook. The agent loads this reference and adapts it to the user's real scale, policy, and latency budget, then emits the SDD via the generic template.
Use when the problem is: rate limiting, throttling, quota/budget enforcement, abuse protection, or cost control in front of an expensive dependency (LLM, search, third-party API).
Ask once if missing: enforcement point (edge / gateway / in-service / layered), the limit key (user / token / IP / tenant / endpoint), hard vs soft limit, fail-open or fail-closed, single vs multi-region, accuracy tolerance.
Read:
- guides/design-method.md
- guides/writing-style.md
- guides/templates/system-design.md
- guides/pipeline.md
Generate the SDD using the template, filled with the reference below, adapted to user scale.
Save to .claude/runtime/outputs/architect/design/{feature_id}.md. Sensors: sensors/design-structure.md, sensors/design-rigor.md. Evals: evals/design-quality.md.
Reference architecture (adapt, do not copy blindly)
One line: rate limiting is not "a counter with TTL in Redis". That solves part of it. The real design starts from policy, not storage. The organizing question, asked first: what exactly am I protecting, and how much imprecision do I accept to protect it without destroying latency and simplicity? That one question drives almost every decision.
Why it exists (five goals at once)
- Protect finite capacity of a system.
- Fairness between clients, tenants, users.
- Reduce blast radius (a client in a loop, a deploy generating anomalous traffic).
- Sustain commercial models (free / pro / enterprise plans).
- Control cost (services that call expensive dependencies: LLM, search, third parties).
A good design is a set of overlapping limits (global, tenant, user, endpoint, IP security), not a single counter. Policy first, Redis second.
Where to enforce (defense in depth)
| Layer | Good for | Limit |
|---|---|---|
| Edge / CDN | absorb volumetric abuse, L7 DDoS, block early | coarse, lacks rich business context |
| API Gateway | most common place; per token/user/tenant/endpoint | generic API limits; if it becomes a bottleneck the whole platform feels it |
| Inside the service | limit depends on domain context the gateway lacks (expensive report, LLM inference) | semantic / cost limits |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 155 lines · 59 tokens per session scan A 2913e104b28a
rate-limiter is a skill published in the GitHub repository Pierry/harness-kit (3 stars, last pushed 1mo ago), licensed MIT. It adds 59 tokens to every session and 1,924 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
guizang-ppt-skill
生成横向翻页网页 PPT（单 HTML 文件），含 WebGL 背景、演讲者视图、观众屏同步、讲稿备注、章节幕封、数据大字报、图片网格等模板。提供两种风格：① \"电子杂志 × 电子墨水\"（衬线 + 流体背景 + 暖色） ② \"瑞士国际主义\"（无衬线 + 网格点阵 + IKB/柠檬黄/柠檬绿/安全橙高亮）。当用户需要制作分享 / 演讲 / 发布会风格的网页 PPT，或提到\"杂志风 PPT\"、\"瑞士风 PPT\"、\"Swiss Style\"、\"horizontal swipe deck\"时使用。.
comply
Regulatory compliance and audit agent. Maps business regulatory requirements (SOC2/PCI-DSS/HIPAA/ISO 27001), checks control implementations, designs audit trails, and implements Policy as Code. Use when compliance auditing is needed.
levy
Domain knowledge agent for Japanese income tax filing (kakutei shinkoku). Guides income classification, deduction optimization, tax calculation, and filing for freelancers, sole proprietors, and side-business earners. Does not write code.
linkedin-growth
Two-phase LinkedIn lead pipeline driven by linkedin-cli. Phase A imports leads from a search URL or filters, qualifies them against a configurable ICP via sub-agent, and stores them in a local SQLite database with round-robin assignment across one or more LinkedIn accounts. Phase B runs on a schedule per account …
meeting-minutes-taker
Transforms raw meeting transcripts into high-fidelity, structured meeting minutes with iterative review for completeness. This skill should be used when (1) a meeting transcript is provided and meeting minutes, notes, or summaries are requested, (2) multiple versions of meeting minutes need to be merged without losing…
prism
Consultant for NotebookLM steering prompt design. Optimizes Audio/Video/Slide/Infographic output quality through source preparation, prompt engineering, and Custom Goals persona design.