{"uid":"cap_Kr-BitT0X9HXMGTqruZtN","slug":"cloudflare-rate-limit-review-ebf1c365","name":"Cloudflare Rate Limit Review","description":"Cloudflare Rate Limit Review: WAF, Workers, 429 — Reviews a rate-limiting setup on Cloudflare (a WAF rate limiting rule, a Workers Rate Limiting binding, or a counter in your own code) and lists every reason it will not limit what its author thinks it limits. It flags free-plan rules that use the client address or a header field, which the plan refuses, windows the plan does not offer, an address key for callers that are themselves Workers and share one outbound address, a binding number treate…","url":"https://api.aiskills402.com/v1/skills/cf-rate-limit-design/file?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD"],"type":"string"},"headers":{"type":"object","additionalProperties":{"type":"string"}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"ok":true,"file":{"name":"SKILL.md","content":"<the SKILL.md file>","encoding":"utf-8"},"name":"Cloudflare Rate Limit Review: WAF, Workers, 429","skill":"cf-rate-limit-design","sha256":"<sha256 of SKILL.md>","receipt":{"tx":"0x<settlement transaction>","settled":true},"version":"1.0.0","redownload":{"url":"<api>/v1/purchases/<token>","token":"<64 hex chars>"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.03","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.03/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_d1uB-e7ZAq3mWDzV9uiRW","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.03","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Reviews a Cloudflare rate-limiting setup (WAF rule, Workers binding, or custom counter) and lists every reason it will silently fail to enforce the intended limits","exampleAgentPrompt":"I set up a WAF rate limit rule on Cloudflare's free plan using the client IP address as the key and a 1-minute window, but it doesn't seem to be blocking repeat requests — can you audit the configuration and tell me everything that's wrong with it?","exampleUseCases":[{"title":"Free plan WAF rule misconfiguration audit","prompt":"I'm on Cloudflare's free plan and added a rate limit rule that keys on the CF-Connecting-IP header with a 10-second window — it's not triggering at all. Can you review it and list every reason it won't work as intended?"},{"title":"Workers Rate Limiting binding review","prompt":"I've got a Workers Rate Limiting binding in my Cloudflare Worker that's supposed to cap requests per caller, but all my Workers share the same outbound IP and I think that's breaking it — can you audit the setup and tell me what's misconfigured?"},{"title":"Custom rate counter logic check","prompt":"I wrote my own rate limiting counter in my Cloudflare Worker code to return 429 responses, but some users are still getting through. Can you go through the logic and flag every reason it might not be limiting what I think it's limiting?"}],"resultDescription":"Returns a SKILL.md file containing a structured audit report that lists every identified reason the rate-limiting setup will fail to enforce its intended limits — including plan incompatibilities, unsupported window sizes, invalid key fields, Workers shared-address pitfalls, binding miscounts, and other logic flaws. Also includes a purchase receipt, redownload token, and a SHA-256 hash of the file.","failureModes":["Missing or malformed input object returns a 400 or schema validation error","Payment not settled or x402 handshake fails returns a 402 Payment Required","Network timeout or upstream error returns a 5xx response","Insufficient USDC balance on Base for $0.03 fee prevents purchase","Redownload token expires or is invalid when attempting re-fetch"],"whenToPreferThis":"Choose this endpoint when you need a structured, expert-level audit of a Cloudflare rate-limiting configuration specifically — WAF rules, Workers Rate Limiting bindings, or custom counter logic. It is distinct from generic security scanners because it understands Cloudflare plan-level restrictions, Workers networking quirks (shared outbound IPs), and window/key-field constraints. Use it when a rate limit rule appears configured correctly but fails to enforce, or before deploying a new rule to catch silent misconfigurations early.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-22T18:55:57.853Z","isFirstParty":false,"canonicalSlug":"cloudflare-rate-limit-review-ebf1c365"}