Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Claude Max Proxy Setup

Use when an agent or developer wants to reduce Claude API costs, route requests through a Claude Max or Pro subscription instead of per-token billing, or set...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 333 · 1 current installs · 1 all-time installs
byDeepBlue@ERROR403agent
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The SKILL.md clearly documents a local proxy that forwards requests via an already-authenticated 'claude' CLI session — this matches the skill name/description. However, the registry metadata lists no required binaries even though the instructions require Node.js (>=20) and the 'claude' CLI. That metadata omission is an inconsistency the user should be aware of.
Instruction Scope
Runtime instructions are narrowly scoped to installing the npm package, starting the proxy (localhost:3456), configuring clients to point at the local base URL, and optionally creating a user-level systemd service. The doc warns not to expose the port and to review source code. It does not instruct reading unrelated system files or exfiltrating data.
Install Mechanism
Install is via 'npm install -g claude-max-api-proxy' (no bundled code files in the skill). npm global installs are a moderate risk because package install scripts can run arbitrary commands; the SKILL.md points to a GitHub repo for review, which is appropriate. The install method is expected for this purpose but merits source review before running.
Credentials
The skill declares no required environment variables, which is coherent. It relies on an already-authenticated local 'claude' CLI session (which will have credentials/tokens stored by that CLI). This is proportional to the advertised purpose but is a sensitive dependency: anyone who can access port 3456 or the 'claude' CLI session can use your subscription.
Persistence & Privilege
The skill does not request always:true and does not demand elevated privileges. The optional systemd user service runs at the user level (writes to ~/.config/systemd/user) which is normal for a user-run proxy. No modifications to other skills or system-wide privileged settings are instructed.
Scan Findings in Context
[no_code_files_to_scan] expected: The package is instruction-only in the registry (SKILL.md only), so the regex scanner had no code files to analyze. This is expected but means static scanning produced no signal; review the GitHub repo before installing the npm package.
Assessment
This skill appears to do what it says: create a local OpenAI-compatible proxy that forwards to your authenticated Claude CLI session. Before installing: 1) Confirm you have Node.js (>=20) and the 'claude' CLI installed and logged in (the registry metadata omitted these requirements). 2) Review the claude-max-api-proxy GitHub repository and npm package contents — npm install scripts can run arbitrary commands. 3) Do not expose port 3456 to untrusted networks; the proxy uses your CLAUDE subscription credentials via the local CLI, so anyone who can reach the port can consume your quota. 4) If running as a systemd user service, it will run with your user privileges (not root) but will persist across sessions. If you are on a shared machine or don't trust the package source, do not install or run the proxy.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.1.0
Download zip
claudevk974rbv5gc86jb5bawxdcfqxt181tyjqcost-savingsvk974rbv5gc86jb5bawxdcfqxt181tyjqinfrastructurevk974rbv5gc86jb5bawxdcfqxt181tyjqlatestvk97eacj96h77g2h6jgnhznfkz981tzwkproxyvk974rbv5gc86jb5bawxdcfqxt181tyjq

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Claude Max API Proxy Setup

Overview

Replace per-token Claude API billing ($15-75/M tokens) with a flat-rate proxy through your Claude Max ($200/mo) or Pro ($20/mo) subscription. The claude-max-api-proxy package exposes your authenticated Claude Code CLI session as an OpenAI-compatible HTTP endpoint on localhost:3456.

How it works: The proxy uses your already-authenticated claude CLI session to forward requests. No API keys are stored or transmitted by the proxy — it relies on your local CLI login. Any OpenAI-compatible client (OpenClaw, LangChain, custom scripts) connects to localhost:3456.

Source code: github.com/atalovesyou/claude-max-api-proxy — review the source before installing.

When to Use

  • Agent API costs exceed $20/month and you have a Claude Max or Pro subscription
  • You want to run Claude Opus 4.6, Sonnet 4.6, or Haiku 4.5 without per-token charges
  • You're configuring OpenClaw, LangChain, or any OpenAI-compatible client to use Claude

Do not use when:

  • You don't have a Claude Max or Pro subscription (get one first at claude.ai)
  • You need concurrent request throughput >5 (Max plan has rate limits)
  • You're on a shared server where others could access port 3456

Security Notes

  • The proxy binds to localhost only by default — it is not accessible from other machines
  • It uses your authenticated claude CLI session, meaning anyone with access to port 3456 on your machine can make requests against your subscription
  • Never expose port 3456 to the public internet — use firewall rules to restrict access
  • Review the package source before installing

Setup Process

1. Prerequisites Check

# Verify Node.js 20+
node --version

# Verify Claude Code CLI is installed and authenticated
claude --version
claude --print "test"   # Should return a response without errors

If claude is not authenticated, run claude login and complete the browser flow.

2. Install and Start

# Review the package source first: https://github.com/atalovesyou/claude-max-api-proxy
npm install -g claude-max-api-proxy
claude-max-api   # Starts on localhost:3456 by default

# Verify:
curl http://localhost:3456/health
# => {"status":"ok","provider":"claude-code-cli",...}

3. Configure Your Client

For OpenClaw (~/.openclaw/openclaw.json):

{
  "env": {
    "OPENAI_API_KEY": "not-needed",
    "OPENAI_BASE_URL": "http://localhost:3456/v1"
  },
  "models": {
    "providers": {
      "openai": {
        "baseUrl": "http://localhost:3456/v1",
        "apiKey": "not-needed",
        "models": [
          { "id": "claude-opus-4", "name": "Claude Opus 4.6 (Max)", "contextWindow": 200000, "maxTokens": 16384 },
          { "id": "claude-sonnet-4", "name": "Claude Sonnet 4.6 (Max)", "contextWindow": 200000, "maxTokens": 16384 },
          { "id": "claude-haiku-4", "name": "Claude Haiku 4.5 (Max)", "contextWindow": 200000, "maxTokens": 8192 }
        ]
      }
    }
  }
}

For any OpenAI-compatible client:

  • Base URL: http://localhost:3456/v1
  • API key: any non-empty string (proxy ignores it)
  • Model IDs: claude-opus-4, claude-sonnet-4, claude-haiku-4

4. Run as Persistent Service (Optional)

# Create systemd user service
# Adjust paths below to match your system — find yours with:
#   which claude-max-api
#   echo $HOME
mkdir -p ~/.config/systemd/user
cat > ~/.config/systemd/user/claude-max-api-proxy.service << EOF
[Unit]
Description=Claude Max API Proxy
After=network.target

[Service]
Type=simple
ExecStart=$(which claude-max-api)
Environment=HOME=$HOME
Environment=PATH=$HOME/.npm-global/bin:/usr/local/bin:/usr/bin:/bin
Restart=on-failure
RestartSec=5

[Install]
WantedBy=default.target
EOF

systemctl --user daemon-reload
systemctl --user enable claude-max-api-proxy
systemctl --user start claude-max-api-proxy

5. Verify

curl http://localhost:3456/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model":"claude-opus-4","messages":[{"role":"user","content":"Say: proxy working"}]}'

Model ID Reference

Proxy Model IDCLI AliasBest For
claude-opus-4opusComplex reasoning, research, long-form
claude-sonnet-4sonnetFast + capable, most tasks
claude-haiku-4haikuSimple tasks, high speed

Common Mistakes

MistakeFix
claude: command not foundnpm install -g @anthropic-ai/claude-code
Proxy returns auth errorsRun claude login and complete browser auth
Rate limit errors with Max planAdd "maxConcurrency": 1 to agent config; Max has limits
Config not taking effectRestart your agent/client after changing config
Proxy dies on rebootSet up systemd service (Step 4 above)

Cost Comparison

SetupMonthly Cost
Claude Opus 4.6 API (active agent)$200-500+
Claude Max + this proxy$200 flat
Claude Pro + this proxy$20 flat (lower rate limits)

Need Help?

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…