How do I install the AI LLM Dos skill?

Run npx skillmds@latest add noorqureshi/ai-llm-dos in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is AI LLM Dos safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with AI LLM Dos?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is AI LLM Dos free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published AI LLM Dos?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

AI LLM Dos by noorqureshi — Agent Skill

Name: AI LLM Dos
Author: NoorQureshi

AI LLM Dos

Unbounded-consumption / denial-of-wallet attacks on LLM apps — force runaway tokens, cost, or latency. Load when testing an LLM product's limits/billing, on "LLM DoS", cost amplification, or resource exhaustion. Signals: user-controlled prompts/max_tokens, agent loops, no rate/'cost caps'.

NoorQureshi Updated Sep 17, 2026

File contents

LLM unbounded consumption (denial-of-wallet)

When it applies

An LLM feature lets users drive expensive computation with weak limits. Unlike classic DoS, the damage is often financial (the provider bills per token) — "denial of wallet" — plus latency/availability.

Why it works

Inference cost scales with tokens and calls. If the app lets users control input size, output length (max_tokens), recursion (agent loops, tool chains), or call volume without hard caps, an attacker amplifies cost/latency far beyond normal use.

Method

Input amplification: send very long inputs, or inputs that induce very long outputs ("repeat X 10000 times", "write an exhaustive…"); push max_tokens if client-controlled.
Recursion / loops: with agents, craft prompts that trigger long tool-call loops or self-referential expansion (→ ai-agent-tool-abuse) that burn calls.
Volume: bypass rate limits (→ web-rate-limit-bypass) and fan out concurrent expensive requests.
Retrieval blow-up: in RAG, queries that pull huge context each call multiply token cost.
Measure impact: latency spike, error/timeout rates, or (where visible) token/cost per request × achievable rate.

Gotchas

Frame it as impact (cost/availability), not just "it was slow" — quantify tokens/cost or a service degradation.
Respect RoE strictly — this can run up real bills / affect availability; prove with minimal, controlled requests, don't sustain an outage.
Defenders: cap input/output tokens, per-user quotas & spend caps, loop/tool budgets, timeouts.

Verify success

A single request (or a modest, controlled burst) demonstrably drives disproportionate token/cost or latency — showing missing consumption limits.

References

OWASP LLM Top 10 (2025) LLM10; "denial of wallet" research; provider rate/quota docs.

---name: ai-llm-dosdescription: Unbounded-consumption / denial-of-wallet attacks on LLM apps — force runaway tokens, cost, or latency. Load when testing an LLM product's limits/billing, on "LLM DoS", cost amplification, or resource exhaustion. Signals: user-controlled prompts/max_tokens, agent loops, no rate/'cost caps'.---# LLM unbounded consumption (denial-of-wallet)## When it appliesAn LLM feature lets users drive expensive computation with weak limits. Unlike classic DoS, thedamage is often financial (the provider bills per token) — "denial of wallet" — plus latency/availability.## Why it worksInference cost scales with tokens and calls. If the app lets users control input size, outputlength (`max_tokens`), recursion (agent loops, tool chains), or call volume without hard caps, anattacker amplifies cost/latency far beyond normal use.## Method1. **Input amplification**: send very long inputs, or inputs that induce very long outputs ("repeat X 10000 times", "write an exhaustive…"); push `max_tokens` if client-controlled.2. **Recursion / loops**: with agents, craft prompts that trigger long tool-call loops or self-referential expansion (→ `ai-agent-tool-abuse`) that burn calls.3. **Volume**: bypass rate limits (→ `web-rate-limit-bypass`) and fan out concurrent expensive requests.4. **Retrieval blow-up**: in RAG, queries that pull huge context each call multiply token cost.5. **Measure impact**: latency spike, error/timeout rates, or (where visible) token/cost per request × achievable rate.## Gotchas- Frame it as impact (cost/availability), not just "it was slow" — quantify tokens/cost or a service degradation.- Respect RoE strictly — this can run up real bills / affect availability; prove with minimal, controlled requests, don't sustain an outage.- Defenders: cap input/output tokens, per-user quotas & spend caps, loop/tool budgets, timeouts.## Verify successA single request (or a modest, controlled burst) demonstrably drives disproportionate token/cost orlatency — showing missing consumption limits.## ReferencesOWASP LLM Top 10 (2025) LLM10; "denial of wallet" research; provider rate/quota docs.

Frequently asked questions