free-claude-code-proxy
Warn
Audited by Socket on Oct 5, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
The skill's stated purpose matches its behavior: it reroutes Claude Code traffic through a local proxy to alternate model providers. The main concerns are supply-chain trust and credential forwarding: the skill asks users to install and run third-party proxy code from an unrelated GitHub repo, then place multiple provider API keys and redirected Claude traffic through it. This looks more like a high-risk proxy/integration skill than confirmed malware, but the install path and trust boundaries are significant enough to classify as suspicious/high risk.
Confidence: 88%Severity: 81%
Audit Metadata