free-claude-code-proxy
Fail
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The installation guide involves executing external code via piped shell commands and tool installers.
- Fetches and runs a script from Astral's official site to install the
uvpackage manager:curl -LsSf https://astral.sh/uv/install.sh | sh. - Installs the primary tool directly from a third-party GitHub repository:
uv tool install git+https://github.com/Alishahryar1/free-claude-code.git. - [CREDENTIALS_UNSAFE]: The skill instructs users to input and manage highly sensitive API keys (e.g., NVIDIA_NIM_API_KEY, KIMI_API_KEY, OPENROUTER_API_KEY) in a local configuration file or through an unauthenticated local Admin UI.
- [COMMAND_EXECUTION]: The instructions require running various commands that modify the system, such as installing global npm packages, managing Python toolchains, and starting server processes that listen on local network ports.
- [DATA_EXFILTRATION]: As a proxy service, the tool intercepts communications between the AI client and external providers. This includes sensitive prompts and API credentials. While this is the intended purpose, it represents a data-handling layer that users must trust to not mismanage or leak information.
Recommendations
- HIGH: Downloads and executes remote code from: https://astral.sh/uv/install.sh - DO NOT USE without thorough review
Audit Metadata