Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Claude Code model-switching tool, but it changes global agent configuration, handles API keys, routes prompts to third-party model providers, and can leave a local gateway running.
Install only if you intentionally want Claude Code traffic routed to third-party model providers and are comfortable with this skill modifying your user-level Claude settings. Use non-sensitive test prompts first, review any ~/.claude/profiles files for real API keys before switching, and stop/remove the local gateway and backups if you no longer need them.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
先看账号可用清单：
curl -s https://api.deepseek.com/models -H "Authorization: Bearer $KEY"
再拿候选名逐个打 Anthropic 兼容端点（这才是权威，/models 常漏别名）：
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
先看账号可用清单:
curl -s https://api.deepseek.com/models -H "Authorization: Bearer $KEY"
再拿候选名逐个打 Anthropic 兼容端点(这才是权威,/models 常漏别名):
This command extracts ANTHROPIC_AUTH_TOKEN directly from ~/.claude/settings.json into a shell variable for subsequent external requests. Even if the document advises not to print the key later, harvesting a credential from agent config materially increases the risk of leakage through logs, process inspection, shell history, or misuse by downstream commands.
再拿候选名逐个打 Anthropic 兼容端点（这才是权威，/models 常漏别名）：
KEY=$(python -c "import json;print(json.load(open(r'C:/Users/<u>/.claude/settings.json'))['env']['ANTHROPIC_AUTH_TOKEN'])")
for M in "deepseek-flash" "deepseek-flash[1m]" "deepseek-v4-flash" "deepseek-chat" "deepseek-v4.1-flash"; do
printf '%-24s => ' "$M"
curl -s -m 45 https://api.deepseek.com/anthropic/v1/messages \
Referencing ~/.claude/settings.json as the authoritative configuration path encourages modification and inspection of a sensitive agent config directory. In isolation the template is documentation, but in an agent skill this normalizes access to a location that commonly stores tokens and model routing settings.
~/.claude/settings.json（用户级、跨项目，是唯一真相源）：
{
The skill instructs reading project and user Claude configuration files, including .claude/settings.json, .claude/settings.local.json, and ~/.claude.json, which may contain API keys and other secrets. In a skill context, directing an agent to access these locations increases the chance of secret exposure beyond what is necessary for normal task completion.
except FileNotFoundError: pass "
cat .claude/settings.json .claude/settings.local.json 2>/dev/null
python -c "import json;d=json.load(open(r'C:/Users//.claude.json'));print({k:d[k] for k in ('model','env','primaryApiKey') if k in d})"
The backup instruction copies the full ~/.claude/settings.json, which likely contains API credentials, into another file location. Secret duplication increases exposure surface and retention time, making accidental disclosure or later compromise more likely.
## 收尾清单
- [ ] 改前备份：`cp ~/.claude/settings.json ~/.claude/backups/settings.json.bak-$(date +%Y%m%d-%H%M%S)`；
若要动 HKCU，先把变量导出一份 json 到同目录。
- [ ] 改后**必须**跑 Step 5 验证主模型 + 子代理模型，不能只看配置文件。
- [ ] 报告里**不要回显 API Key**，只说前缀 + 长度。
Declaring ~/.claude/settings.json as the single source of truth encourages placing all credentials and routing configuration into one agent-readable file. In a skill, that increases the blast radius if the file is later read, copied, or modified by other automation.
## Step 14 · 单一配置源（Single Source of Truth）
**结论：配置只写在 `~/.claude/settings.json`，不要同时在 Windows 环境变量里放一份。**
理由（实测）：
1. **环境变量那份根本不起作用**。`settings.json` 的 `env` 块优先级更高（Step 5），
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
import os, subprocess, re
env = {k:v for k,v in os.environ.items()
if not (k.upper().startswith("ANTHROPIC") or k.upper().startswith("CLAUDE_CODE"))}
p = subprocess.run([r"C:/Users/<u>/AppData/Roaming/npm/claude.cmd",
"-p", "hi", "--output-format", "json"],
The profile-switching design copies complete profile JSON files over ~/.claude/settings.json, potentially overwriting or proliferating embedded secrets and changing agent behavior silently. This creates both credential-handling risk and integrity risk for the agent's runtime configuration.
## 设计（可直接照搬到别的工具）
1. **profile 即模板**：`~/.claude/profiles/<name>.json` 存一份完整的 Claude Code
`settings.json`；切换 = 复制覆盖 `~/.claude/settings.json`。
2. **切前必备份**：旧文件存 `~/.claude/backups/settings.json.bak-<时间戳>`；
与目标内容相同则跳过（不刷屏）。
3. **是否需要网关由配置自身推出**，不靠额外元数据：
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
oa_req = anthropic_to_openai(req)
except Exception as e:
self._send_error_anthropic(400, "invalid_request_error", "translate: %s" % e)
return
prompt_chars = sum(len(str(m.get("content", ""))) for m in oa_req["messages"])
model_for_reply = req.get("model") or CONFIG["upstream"].get("model")
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
How it works:
A profile is a JSON file in ~/.claude/profiles/<name>.json that fully
describes Claude Code's settings.json for that upstream. Switching =
copy profile -> ~/.claude/settings.json, then reconcile the gateway:
* profile whose ANTHROPIC_BASE_URL points at 127.0.0.1:<gateway port>
=> local ccproxy gateway MUST be running -> start if down
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
How it works:
A profile is a JSON file in ~/.claude/profiles/<name>.json that fully
describes Claude Code's settings.json for that upstream. Switching =
copy profile -> ~/.claude/settings.json, then reconcile the gateway:
* profile whose ANTHROPIC_BASE_URL points at 127.0.0.1:<gateway port>
=> local ccproxy gateway MUST be running -> start if down
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
if not CCPROXY.exists():
die("ccproxy.py not found: " + str(CCPROXY))
GATEWAY_LOG.parent.mkdir(parents=True, exist_ok=True)
env = os.environ.copy()
for k in ("HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy",
"ALL_PROXY", "all_proxy"):
env.pop(k, None)
L010 列出大量触发说法，其中“给 claude code 配置 deepseek/别的模型”“现在什么模型”等表述较泛，且未说明必须在何种上下文中才应激活该技能。文档也没有提供负例或排除条件来收窄触发范围，因此存在与普通对话重叠的风险。
Calling https://api.deepseek.com/ is an outbound network action to a third-party service. In this skill, that matters because the action is coupled with model validation and may involve protected credentials or prompt content being sent off-host.
先看账号可用清单：
curl -s https://api.deepseek.com/models -H "Authorization: Bearer $KEY"
再拿候选名逐个打 Anthropic 兼容端点（这才是权威，/models 常漏别名）：
Calling https://api.deepseek.com/ is an outbound network action to a third-party service. In this skill, that matters because the action is coupled with model validation and may involve protected credentials or prompt content being sent off-host.
先看账号可用清单：
curl -s https://api.deepseek.com/models -H "Authorization: Bearer $KEY"
再拿候选名逐个打 Anthropic 兼容端点（这才是权威，/models 常漏别名）：
This command sends a live request to a third-party endpoint using an API key harvested from local Claude settings. That combines secret access with outbound transmission, creating a clear path for credential misuse and possible data leakage to an untrusted remote service.
KEY=$(python -c "import json;print(json.load(open(r'C:/Users/<u>/.claude/settings.json'))['env']['ANTHROPIC_AUTH_TOKEN'])")
for M in "deepseek-flash" "deepseek-flash[1m]" "deepseek-v4-flash" "deepseek-chat" "deepseek-v4.1-flash"; do
printf '%-24s => ' "$M"
curl -s -m 45 https://api.deepseek.com/anthropic/v1/messages \
-H "x-api-key: $KEY" -H "anthropic-version: 2023-06-01" -H "content-type: application/json" \
-d "{\"model\":\"$M\",\"max_tokens\":8,\"messages\":[{\"role\":\"user\",\"content\":\"hi\"}]}" \
| python -c "import sys,json;d=json.load(sys.stdin);print('OK ->',d['model'] if 'model' in d else 'ERR '+str(d.get('error',{}).get('message'))[:160])"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- 用同目录 `tag.txt` 给每一轮实验打标签，避免多次运行串味。
- `ANTHROPIC_BASE_URL` 支持 `http://`，指向 127.0.0.1 时记得把 `NO_PROXY` 加上 `127.0.0.1`。
**⚠️ 最大坑**：在 Bash 工具里用 `nohup ... &` 起的中继会**随该次命令的进程组一起被杀**，
表现为「Claude Code 连不上 → 一直重试 → 看起来像卡死」，
而且因为 SIGTERM 打断管道，**连报错都看不到**。
必须用工具自带的后台运行能力（`run_in_background`）启动长驻进程。
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- 用同目录 `tag.txt` 给每一轮实验打标签，避免多次运行串味。
- `ANTHROPIC_BASE_URL` 支持 `http://`，指向 127.0.0.1 时记得把 `NO_PROXY` 加上 `127.0.0.1`。
**⚠️ 最大坑**：在 Bash 工具里用 `nohup ... &` 起的中继会**随该次命令的进程组一起被杀**，
表现为「Claude Code 连不上 → 一直重试 → 看起来像卡死」，
而且因为 SIGTERM 打断管道，**连报错都看不到**。
必须用工具自带的后台运行能力（`run_in_background`）启动长驻进程。
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Anthropic 协议 Base URL（Claude Code 用这个）：`https://open.bigmodel.cn/api/anthropic`
- ⚠️ 末尾**不要加 `/v1`**——Claude Code 会自动拼 `/v1/messages`，拼成
`https://open.bigmodel.cn/api/anthropic/v1/messages`（这正是智谱的正确路径）。
- 国际站 z.ai 同协议：`https://api.z.ai/api/anthropic`（Key 用 z.ai 平台发的）。
- API Key：`https://open.bigmodel.cn/usercenter/apikeys` 创建。
填进 `ANTHROPIC_AUTH_TOKEN`（即 Key 本身，CC 会带 `x-api-key` 头，别加 `Bearer `）。
- 模型 ID（小写，OpenAI/Anthropic 端点通用）：
The skill recommends routing Claude Code traffic through third-party OpenAI-compatible endpoints, including anonymous/keyless providers. This can redirect sensitive prompts and tool outputs to services with unclear identity, retention, and access controls.
|---|---|---|---|
| **OpenCode Zen** | `https://opencode.ai/zen/v1/chat/completions` | `space-bunny-free` | **免 key（匿名）可用** |
| OpenRouter | `https://openrouter.ai/api/v1/chat/completions` | `stealth/space-bunny-alpha` | 需 key（注意：整段 `:free` 后缀会 404） |
| AI/ML API | `https://api.aimlapi.com/v1/chat/completions` | `stealth/space-bunny-alpha` | 需 key |
- **OpenCode Zen 免 key 实测（2026-09-29）**：不带任何 `Authorization` 头直接 POST
`space-bunny-free` 即返回真实结果、`cost:"0"`。**账号被封也不用怕，直接换 Zen。**
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
npm install -g）mkdir -p "C:/Users/<u>/.workbuddy/binaries/node/workspace"
cd "C:/Users/<u>/.workbuddy/binaries/node/workspace"
"<node.exe>" "<版本根目录>/node_modules/npm/bin/npm-cli.js" install claude-code-router
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
python ccproxy.py --port 3457 --verbose # 前台带日志
python ccproxy.py --upstream <url> --model <name> --key <k> # 临时换上游
curl -s http://127.0.0.1:3457/health # {"ok":true,"upstream":...}
CLI 参数优先于配置文件。当前上游：https://opencode.ai/zen/v1/chat/completions +
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"$schema": "https://json.schemastore.org/claude-code-settings.json",
"env": {
"ANTHROPIC_AUTH_TOKEN": "sk-YOUR-DEEPSEEK-KEY-HERE",
"ANTHROPIC_BASE_URL": "https://api.deepseek.com/anthropic",
"ANTHROPIC_DEFAULT_FABLE_MODEL": "deepseek-flash[1m]",
"ANTHROPIC_DEFAULT_FABLE_MODEL_NAME": "deepseek-flash",
"ANTHROPIC_DEFAULT_HAIKU_MODEL": "deepseek-flash",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"$schema": "https://json.schemastore.org/claude-code-settings.json",
"env": {
"ANTHROPIC_AUTH_TOKEN": "sk-YOUR-DEEPSEEK-KEY-HERE",
"ANTHROPIC_BASE_URL": "https://api.deepseek.com/anthropic",
"ANTHROPIC_DEFAULT_FABLE_MODEL": "deepseek-flash[1m]",
"ANTHROPIC_DEFAULT_FABLE_MODEL_NAME": "deepseek-flash",
"ANTHROPIC_DEFAULT_HAIKU_MODEL": "deepseek-flash",
Detected: suspicious.install_untrusted_source