performing-api-rate-limiting-bypass

The skill is internally coherent and not a disguised credential stealer, but it equips an AI agent with high-risk offensive API testing tactics that can bypass protections and generate disruptive traffic. Classify as suspicious/high-risk vulnerable rather than malware.

This module is not obfuscated and does not contain overt stealth/persistence/exfiltration payloads. It is a dual-use offensive security testing utility that actively probes a user-supplied API endpoint with crafted request vectors intended to detect or potentially bypass rate limiting (spoofed proxy/IP headers, method differences, path/encoding normalization tricks, and %00 null-byte suffix). Security risk depends heavily on authorization and deployment context; if executed against systems without permission, it can enable policy-evasion and cause undesirable load.