rate-limiter
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill instructions and code examples follow security best practices for API throttling, including layered limits and proper HTTP header usage.
- [INDIRECT_PROMPT_INJECTION]: The skill instructions and code examples demonstrate the ingestion of untrusted client data, such as IP addresses and user identifiers, to manage rate limits.
- Ingestion points: The rateLimit middleware in SKILL.md accesses req.ip and req.userId to generate Redis keys.
- Boundary markers: Not applicable; the logic is implemented in a standard middleware flow.
- Capability inventory: The code example utilizes ioredis for database interaction; no subprocess calls, local file writes, or external network requests are present across the provided content.
- Sanitization: Identifiers are used as Redis keys; standard database driver parameterization is used via the ioredis library.
Audit Metadata