claude-code-proxy-patterns
Facilitates multi-provider model routing for Claude Code using OAuth proxy patterns, enhancing integration and resilience.
Install this skill
Security score
The claude-code-proxy-patterns skill was audited on Mar 7, 2026 and we found 29 security issues across 5 threat categories, including 10 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Python subprocess execution
| 79 | result = subprocess.run( |
Curl to non-GitHub URL
| 209 | curl -s http://127.0.0.1:8082/health | jq . |
Access to hidden dotfiles in home directory
| 159 | 3. ~/.claude/.credentials.json -> Authorization: Bearer (plaintext fallback) |
Access to hidden dotfiles in home directory
| 197 | ~/.claude/bin/proxy-toggle enable # Adds env vars, creates flag file, checks health |
Access to hidden dotfiles in home directory
| 198 | ~/.claude/bin/proxy-toggle disable # Removes env vars, removes flag file |
Access to hidden dotfiles in home directory
| 199 | ~/.claude/bin/proxy-toggle status # Shows routing flag, proxy process, .zshenv state |
Access to hidden dotfiles in home directory
| 256 | | CCP-05 | MEDIUM | Reading `~/.claude/.credentials.json` as primary | Keychain is SSoT; credential file is stale fallback | |
Access to hidden dotfiles in home directory
| 280 | | `~/.claude/tools/claude-code-proxy-go/main.go` | Go proxy source | |
Access to hidden dotfiles in home directory
| 281 | | `~/.claude/tools/claude-code-proxy-go/oauth_refresh.go` | OAuth auto-refresh (80 lines) | |
Access to hidden dotfiles in home directory
| 282 | | `~/.claude/tools/claude-code-proxy-go/.env` | Provider config (chmod 600) | |
Access to hidden dotfiles in home directory
| 284 | | `~/.zshenv` | Environment (ANTHROPIC_BASE_URL) | |
Access to .env file
| 282 | | `~/.claude/tools/claude-code-proxy-go/.env` | Provider config (chmod 600) | |
Access to system keychain/keyring
| 3 | description: Claude Code OAuth proxy patterns and anti-patterns for multi-provider model routing. TRIGGERS - proxy Claude Code, OAuth token Keychain, route Haiku to MiniMax, ANTHROPIC_BASE_URL, model |
Access to system keychain/keyring
| 69 | ### WP-01: Keychain OAuth Token Reading |
Access to system keychain/keyring
| 71 | Read OAuth tokens from macOS Keychain where Claude Code stores them. |
Access to system keychain/keyring
| 94 | The Keychain stores a JSON envelope with the `claudeAiOauth` key. |
Access to system keychain/keyring
| 138 | Avoid repeated Keychain subprocess calls by caching the token for 5 minutes. |
Access to system keychain/keyring
| 143 | _OAUTH_CACHE_TTL = 300 # Re-read from Keychain every 5 minutes |
Access to system keychain/keyring
| 158 | 2. Keychain OAuth token -> Authorization: Bearer + anthropic-beta |
Access to system keychain/keyring
| 240 | Background goroutine refreshes OAuth tokens every 30 minutes, 5 minutes before expiry. Falls back to Keychain if API refresh fails. |
Access to system keychain/keyring
| 255 | | CCP-04 | HIGH | Lowercase keychain service `"claude-code-credentials"` | Actual name has space: `"Claude Code-credentials"` | |
Access to system keychain/keyring
| 256 | | CCP-05 | MEDIUM | Reading `~/.claude/.credentials.json` as primary | Keychain is SSoT; credential file is stale fallback | |
Access to system keychain/keyring
| 309 | | Keychain read returns empty | Wrong service name (CCP-04) | Use `"Claude Code-credentials"` (with space) | |
Access to system keychain/keyring
| 315 | | Token expired after 5 min | Cache TTL (WP-05) | Normal behavior; proxy re-reads from Keychain | |
External URL reference
| 38 | | ANTHROPIC_BASE_URL=http://127.0.0.1:8082 (Go proxy) |
External URL reference
| 130 | export ANTHROPIC_BASE_URL="http://127.0.0.1:8082" |
External URL reference
| 176 | | MiniMax M2.5-highspeed | `https://api.minimax.io/anthropic` | Returns `base_resp` field, extra `thinking` block | |
External URL reference
| 209 | curl -s http://127.0.0.1:8082/health | jq . |
External URL reference
| 228 | **Location**: `/usr/local/bin/claude-proxy` | **Environment**: `ANTHROPIC_BASE_URL=http://127.0.0.1:8082` in `.zshenv` |
Install this skill with one command
/learn @terrylica/claude-code-proxy-patterns