Skip to content

v2.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Jun 05:24
v2.3.0
a8db16a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v2.3: Local 14-step AI API relay security audit

API Relay Audit v2.3 is a local security audit tool for AI API relays and LLM
proxies. It detects prompt injection, model substitution, tool-call rewriting,
SSE anomalies, error leakage, upstream channel mismatch, latency variance, and
Web3 wallet risks. Your API key is sent only to the relay URL you choose.

Quick Start

AUDIT_SCRIPT_REF=v2.3.0
curl -fsSL "https://raw.githubusercontent.com/toby-bridges/api-relay-audit/${AUDIT_SCRIPT_REF}/audit.py" -o audit.py
python3 audit.py --key <YOUR_KEY> --url <BASE_URL> --output report.md

# Web3 / wallet users
python3 audit.py --key <YOUR_KEY> --url <BASE_URL> --profile web3 --output report.md

What Changed

  • Local 14-step audit coverage for AI API relays and LLM proxies.
  • Prompt injection, prompt extraction, instruction conflict, and jailbreak
    probes.
  • Model identity and upstream channel mismatch checks.
  • Tool-call rewriting detection for package-command tampering.
  • Error-response leakage checks for credential, header, stack-trace, path, and
    internal-field exposure.
  • Anthropic-style SSE stream integrity checks.
  • Web3 wallet-safety probes with --profile web3 and --profile full.
  • OpenClaw and Hermes Agent skill distribution documentation.
  • GitHub Pages metadata and guide surfaces: English homepage, Chinese page,
    guide pages, sitemap, canonical links, and structured data.
  • Community-health docs and non-code contributor entry points.

Release Verification

  • Source tag: v2.3.0
  • Standalone audit.py SHA-256: c9c1f66cfb6e880f044ba18e7a9e7952f45e688470e299e455c64836b68ab482
  • Required gates before publishing: version sync, standalone drift,
    metrics drift, full pytest, and python3 -S audit.py --help.
  • Published release check: /releases/latest, /releases/tags/v2.3.0, and
    the audit.py / audit.py.sha256 assets should be publicly accessible.

Agent Skill Support

Important Limits

  • API Relay Audit does not certify that a relay is safe.
  • It does not replace manual security review or operational monitoring.
  • inconclusive is not clean; blocked probes and ambiguous responses stay
    visible in the report.
  • Do not publish API keys, wallet material, private relay URLs, or raw traffic
    captures in issues or examples.

Links

Assets 4
Loading