api-relay-audit

What it is

api-relay-audit by toby-bridges, current release v2.4.0. The catalog summary covers the detector scope; what it does not carry is the install/run mechanics, the DeepSeek Harness distribution, cost behavior, and the tool's stated evidentiary limits. It is motivated by the "Your Agent Is Mine" research: Anthropic's September 10, 2026 report on fraudulent Claude resellers that swap models and harvest credentials, and co-author Chaofan Shou's September 11 disclosure of buying router data containing user credentials.

What to do

Standalone script — pin the release tag, do not use master unless deliberately testing unreleased code:

AUDIT_SCRIPT_REF=v2.4.0
curl -fsSL "https://raw.githubusercontent.com/toby-bridges/api-relay-audit/${AUDIT_SCRIPT_REF}/audit.py" -o audit.py
python audit.py --key <YOUR_KEY> --url <BASE_URL> --output report.md

Wallet checks:

python audit.py --key <YOUR_KEY> --url <BASE_URL> --profile web3 --output report.md

DeepSeek Harness plugin (the actively verified distribution path) — also pin an immutable ref:

DSH_PLUGIN_REF=v2.4.0
dsh plugin --profile web add "github:toby-bridges/api-relay-audit#${DSH_PLUGIN_REF}"

Under DSH, running /relay-audit with no arguments performs a full audit and may consume metered tokens; use /relay-audit --connectivity for a lower-cost check.

Preconditions / notes worth knowing

• Profiles: general (default), web3 (wallet probes), full (both).
• Your API key is sent only to the relay URL you supply. Under DSH the credential stays in DSH Credentials and reaches the audit process via an environment variable — never through command arguments or the session log.
• The DSH bundle requires a route that self-identifies as Claude, though the underlying relay may be Anthropic- or OpenAI-compatible. Independent wrappers without DSH profiles are not compatible. OpenClaw and Hermes skill files remain in the repo for direct/downstream use but are not the current registry distribution target.

Caveats

The page is explicit that this is not a pass/fail certifier: it does not certify a relay as safe, does not replace manual review or operational monitoring, and does not treat inconclusive probes as clean — blocked and ambiguous responses stay visible in the report. Critically for model-substitution detection: a response claiming to be Qwen, DeepSeek, GPT, or Claude is treated only as a consistency signal, not upstream proof. Stronger claims of substitution require corroborating evidence such as raw response JSON, request IDs, or provider/model metadata. The example report is a synthetic fixture, not real-relay output.