1 line
12 KiB
JSON
1 line
12 KiB
JSON
{"repo": "astrozeta/api-scam-hunter", "files": {"SKILL.md": {"e3663784f79d382b5fa9fe2f119cfaea4f5ea5e1": {"t": 1785674437.6584353, "n": 11336, "h": "8508e63e1403eb25", "c": "---\nname: api-scam-hunter\ndescription: >\n Detects whether a purchased AI API key/endpoint (Claude/Anthropic, OpenAI, etc.) — often\n bought cheap from a reseller or marketplace like GamsGo — is actually a man-in-the-middle\n proxy that intercepts, rewrites or degrades traffic. Trigger when the user says things\n like \"I bought a third-party API key\", \"is this legit?\", \"got cheap Claude/GPT access\",\n \"the assistant has a different name\", \"it's unusually slow/dumb\", \"BASE_URL points to\n another domain\", \"did I download something fake?\", or \"compré una API key de terceros\",\n \"esto es legítimo?\", \"el asistente se llama distinto\", \"me han vendido acceso barato a\n Claude/GPT\". Use it to verify endpoint authenticity and gather evidence to dispute/report.\n---\n\n# APIScamHunter\n\nVerify whether third-party AI API access (Claude, GPT, etc.) is legitimate or a proxy that\nsits in the middle, reads your traffic, and degrades the service. Defensive use only.\n\n## Why this happens\nResellers sell \"cheap Claude/GPT access\". Instead of a real account you get their API key and\nare told to set `ANTHROPIC_BASE_URL`/`OPENAI_BASE_URL` to their domain — a proxy that forwards\nto the real model but can read everything, rewrite responses, inject its own system prompt,\nand swap in a cheaper model. Cheap price = adulterated product (often, you are the product).\n\n## Fast smell test (no tools)\n1. **Key format** — Anthropic `sk-ant-...`; OpenAI `sk-proj-...`/console `sk-...`. Odd\n prefixes (`sk-b53e...`) are suspicious.\n2. **Base URL** — real is `api.anthropic.com` / `api.openai.com`. Anything else = middleman.\n3. **Identity** — assistant renamed (\"Kiro\", \"AI Assistant\") or refuses to name its model.\n4. **Behaviour** — unusually fast *and* unusually dumb (trimmed prompt / cheaper model).\n\n## Check the configured values\n```powershell\n# Windows\n[Environment]::GetEnvironmentVariable(\"ANTHROPIC_BASE_URL\",\"User\")\n[Environment]::GetEnvironmentVariable(\"ANTHROPIC_API_KEY\",\"User\") # only show the prefix\n```\n```bash\n# macOS / Linux\necho \"$ANTHROPIC_BASE_URL\"; echo \"${ANTHROPIC_API_KEY:0:10}...\"\n```\n(For OpenAI swap `ANTHROPIC_` for `OPENAI_`.)\n\n## Run the full automated check\nEasiest: the orchestrator runs the modules at a chosen depth, gives one verdict and writes a\nMarkdown + HTML report. Levels: Quick (check only), Standard=default (recon + check), Full\n(recon + check + fingerprint + extract), or a single `-Module`/`MODULE=`:\n```\nscripts/apiscamhunter.ps1 -BaseUrl <url> -ApiKey <key> # Windows, Standard\nscripts/apiscamhunter.ps1 -BaseUrl <url> -ApiKey <key> -Full -PricePerMTokIn 1.5\nFULL=1 PRICE=1.5 scripts/apiscamhunter.sh <url> <key> # macOS/Linux\n```\nVerdict = five categories; **🔴 FRAUDULENT BEHAVIOUR requires 2+ independent malicious signals**\n(never accuse on thin evidence). Or run a single module directly (Anthropic + OpenAI auto-detected;\n`-Provider`/`PROVIDER` to force):\n```\nscripts/check-api.ps1 -BaseUrl <url> -ApiKey <key> # Windows\nscripts/check-api.ps1 -Known # you DECLARED a gateway on purpose\nscripts/check-api.sh <url> <key> # macOS/Linux\nKNOWN=1 scripts/check-api.sh <url> <key> # judge malice only\n```\n\n### Score on two axes — keep them separate\n**Axis A — interposition (a fact, not a conviction):** `Via:` header, an `X-Request-Id` that\nconcatenates a proxy id with a real upstream `req_...`, a response missing the native id\n(`msg_...` / `chatcmpl-...`), or a non-official domain. A `Via` header **alone is not fraud** —\nyour own gateway, Cloudflare or a corp proxy add one too. If the user *declared* a gateway, use\n`-Known` so expected interposition isn't flagged.\n\n**Axis B — malicious behaviour (this is what condemns it):**\n- **Model substitution / downgrade** — compare the requested model vs the `model` the response\n reports. Pay for Opus, get Haiku/Qwen → caught. Latency is a secondary tell. **This is the #1\n real scam.**\n- **System-prompt control** — send `system:\"You are a parrot, reply only BANANA\"`, ask \"who are\n you?\". No \"BANANA\" → the proxy discards your prompt and injects its own identity.\n- **Model catalog** — `/v1/models` where every model shares one fake creation timestamp, or an\n Anthropic endpoint returning OpenAI's `\"object\":\"list\"` (the `one-api`/`new-api` reseller stack).\n- **Phantom model** — a non-existent model that doesn't error cleanly → improvised routing.\n- **Fabricated stub / client-gating** — a `200` missing the canonical fields the real API always\n returns (`id`, `role`, `model`, `stop_reason`, `usage`) is a canned payload, not a completion.\n Some proxies reply `\"Please use Claude Code CLI\"` to anything but the genuine binary (likely TLS\n fingerprinting) — an anti-analysis gate that is itself a red flag. Don't mis-label a stub as\n \"system-prompt injection\": they are different frauds, and precision matters in a report.\n- **Streaming compliance** — `stream:true` must return the real Anthropic SSE sequence\n (`message_start → content_block_delta → message_stop`); a rewriting proxy returns a non-streamed\n body or stub.\n- **count_tokens + error-schema** — `/v1/messages/count_tokens` coverage (and token-inflation), plus\n a deliberately invalid request: the real API returns `{\"type\":\"error\",\"error\":{\"type\":\"invalid_request_error\",...}}`;\n a made-up error or a `200` to an invalid body means a rewritten surface.\n- **Prompt caching** — a large `cache_control` block sent twice should report `cache_creation_input_tokens`\n then `cache_read_input_tokens`; missing fields = no caching implemented = possible over-billing for\n cacheable input.\n\n**Gate every body check on a 2xx.** A prepaid reseller key often returns `403\nINSUFFICIENT_BALANCE`; a 4xx body has no \"BANANA\" and no `msg_` id, so judging it as 2xx would\nscream \"fraud\" at a merely-empty key. Read headers on any status (the `Via`/proxy fingerprint\nsurvives errors), but only judge *behaviour* on a real 200.\n\n## Interpreting results\n- **Any Axis B signal → fraud.** Interposition with no malice → \"a middleman is in the path; if\n the user didn't put it there, it still sees every byte.\" All clean → looks like a direct, legit\n endpoint *for this request*.\n- **What this can't catch:** a proxy that forwards your prompt untouched while **logging and\n reselling** it passes every probe — there's no client-side test for silent harvesting. An\n endpoint can also serve the real model during a check and a cheaper one under load. A clean run\n is **not** a safety certificate.\n- The real model may sit behind the proxy (genuine `req_...` ids / `usage` can leak through). The\n danger isn't only \"fake model\" — it's that **a third party reads, edits and can degrade your\n traffic**. **Never send code secrets, tokens or personal data through such an endpoint.**\n\n## If confirmed\n1. Stop using it for anything sensitive.\n2. Restore the official account: remove the env vars and log back into the real endpoint.\n ```powershell\n [Environment]::SetEnvironmentVariable(\"ANTHROPIC_BASE_URL\", $null, \"User\")\n [Environment]::SetEnvironmentVariable(\"ANTHROPIC_API_KEY\", $null, \"User\")\n ```\n3a. Profile the infrastructure with `scripts/recon.ps1` / `.sh` (FREE — no LLM calls, works even\n when the API blocks analysis): DNS/ASN, domain age (RDAP), TLS cert, crt.sh subdomains, security\n headers, the one-api/new-api fingerprint, and an economic-plausibility check (price vs list).\n It reports context, not a verdict — pair it with check-api.\n3b. Fingerprint the served model with `scripts/fingerprint.ps1` / `.sh`: a calibrated reasoning\n battery + self-report + determinism + latency + an ENVIRONMENT/INFRASTRUCTURE probe. Reports a\n CAPABILITY PROFILE, not a hard verdict — it reliably separates a high-tier model from a junk one,\n but CANNOT tell Opus from Sonnet from outside, and says so. One failed probe can be sampling noise\n → re-run before claiming a downgrade. The environment probe asks the model for its real OS/working\n dir several times: if the backend OS != the client's, the session runs on the proxy's OWN\n infrastructure (not a transparent forward); varying working dirs reveal a load-balanced POOL of\n backends (resold/pooled, often stolen, accounts). It also runs a latency profile (min/avg/max) and\n a session-isolation/context-bleed probe (plants a code in one request, asks for it in another; if\n returned, the endpoint shares context/cache = isolation/privacy failure). If the endpoint\n client-gates (stub to scripts), use `-ViaCli` / `VIACLI=1` to route probes through the CLI binary.\n3. Collect evidence. Run `scripts/extract-prompt.ps1` / `.sh` to try to make the proxy reveal\n the system prompt / persona it injects (e.g. \"You are Kiro\") and the model truly serving the\n request; it saves a timestamped transcript. It fires several benign prompt-extraction methods\n (14 in total: direct dump, authority override, assistant prefill, base64 / spaced / zero-width\n / homoglyph to dodge string filters, translate-then-original, XML role-tag injection, a yes/no\n binary-search probe, context overflow, many-shot, identity probe). The binary-search probe is\n the cleanest single signal — it answers whether a foreign persona/model is injected without\n dumping anything. For client-gated proxies add `-ViaCli` / `VIACLI=1`. This is prompt-leaking\n against the user's OWN purchased endpoint to document fraud — never against third-party\n systems. Attach the transcript + check-api output + screenshots to the report.\n4. Report & dispute through legitimate channels (see `docs/REPORTING.md`): the AI provider's\n Trust & Safety, the CDN/host abuse desk (e.g. Cloudflare), the reseller (refund), a\n payment chargeback, and a community warning. **Never** attack their systems — it ruins\n the case and puts you in the wrong.\n\n## The grey market behind \"cheap keys\"\nThese bargain endpoints are known in China as 中转站 (\"transfer stations\" / shadow APIs),\nsold on GitHub, Taobao and Telegram at ~10% of official price. A 2026 CISPA Helmholtz audit\n(\"Real Money, Fake Models\", arXiv:2603.01919) of 17 such services found widespread model\nsubstitution — you pay for Opus and get Haiku or a relabelled Qwen. One endpoint sold as\n\"Gemini-2.5\" scored 37% on a medical benchmark vs ~84% for the official API. Anthropic\nreported a single proxy network running 20,000+ fraudulent accounts. The business model\nrests on three legs: **stolen credentials + model substitution + harvesting your prompts**\n(resold as training data).\n\n### Vet the reseller's reputation (before paying)\n- Search community rankings/listings: GitHub `awesome-ai-proxy` / `中转站` lists, Zhihu,\n apiranking.com, aiapipk.com.\n- Search the **internal** search of closed forums — linux.do, NodeSeek, V2EX — many 跑路\n (\"ran away with the balance\") threads are login-only and never hit Google.\n- **No community footprint = no verifiable reputation = treat as high risk.**\n- Forum consensus on the whole category: any station can 跑路 overnight. Never prepay large\n amounts; top up only what you'll use — and never route anything sensitive through it.\n\n## Golden rule\nLegit model access always goes to the official domain with an official-format key. Any\n\"cheap alternative BASE_URL\" is, at minimum, a middleman that sees all your traffic.\n"}}}} |