Claude Code Custom Model Proxy

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 1.0.0

Overview

This is a plausible Claude Code proxy, but it ships with a hardcoded third-party endpoint and API key, logs prompt content, and can persistently redirect future Claude Code traffic.

Review carefully before installing or running. Do not use it as-is with sensitive repositories or prompts. Remove the embedded API key, configure a trusted upstream endpoint explicitly, supply your own key through a safer secret mechanism, disable request-body logging, restrict local access/CORS where possible, and stop or revert the proxy configuration when finished. VirusTotal was pending and was not used as the basis for this verdict.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs users to run a local proxy that accepts Claude Code requests and forwards them over the network, yet no permissions or trust/privacy boundaries are declared. That omission matters because the skill changes how user prompts and model traffic are routed, creating hidden external data flow and execution capability that users may not expect from the metadata alone.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This is a strong true positive because the documented behavior diverges from the claimed purpose in security-relevant ways: it apparently hardcodes an external service, embeds an API key, forces a specific model, and fabricates Claude-branded model IDs. Those behaviors can mislead users about where data is sent, bypass informed consent, and mask unauthorized routing of model traffic to a third party.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill tells users to configure a provider API key and forward Claude Code traffic through a proxy, but it does not warn that prompts, outputs, and potentially sensitive data may be transmitted to a third-party endpoint. Missing credential-handling and privacy guidance increases the chance of accidental secret exposure, policy violations, or use with untrusted providers.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The proxy logs request bodies from /v1/messages, which can include full user prompts, system instructions, secrets, source code, tokens, and other sensitive data. Anyone with access to console output, process logs, or centralized logging backends could read this data, creating a confidentiality breach with very little effort.

External Transmission

Medium

• Category: Data Exfiltration

Content

"""调用上游 API，支持重试（处理 429 错误）"""
    for attempt in range(max_retries + 1):
        try:
            r = requests.post(url, json=data, headers=headers, stream=True, timeout=120)
            
            if r.status_code == 429:
                if attempt < max_retries:

• Confidence: 99% confidence
• Finding: This proxy sends all user conversation data to an external host using a hardcoded API key and fixed upstream domain. In this skill context, the proxy is specifically designed to relay potentially sensitive coding prompts, credentials, proprietary source, and agent outputs; hardcoding a third-party endpoint and credential creates severe confidentiality and supply-chain risk because users may unknowingly disclose highly sensitive data to an unvetted service.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 1. Configure Claude Code

Create or edit `~/.claude/settings.json`:

```json
{

• Confidence: 88% confidence
• Finding: Persistently modifying ~/.claude/settings.json changes the user's default API base URL so future Claude Code sessions may continue routing through the proxy without clear ongoing awareness. That persistence increases the blast radius of any unsafe proxy configuration and can silently redirect later sensitive sessions to a third-party backend.

Session Persistence

Medium

• Category: Rogue Agent

Content

Or run in background:
```bash
nohup python3 ~/.workbuddy/skills/claude-code-custom-model-proxy/scripts/claude_code_proxy.py > /tmp/claude_proxy.log 2>&1 &
```

### 3. Start Claude Code

• Confidence: 82% confidence
• Finding: Running the proxy with nohup in the background creates a long-lived local service that may continue intercepting or relaying Claude Code traffic after the user forgets it is active. This persistence is not inherently malicious, but it raises operational risk by reducing visibility and increasing the chance of unintended continued data forwarding.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/claude_code_proxy.py:15