api-relay-audit — Audit AI API Relays for Prompt Attacks

Main

• Treat it as a pre-flight checklist for any API relay/proxy: run once, archive the Markdown report, then re-run after provider updates.

• Use the built-in profiles (general, web3, full) to match your threat model and cost/time budget.

• Focus on relay integrity signals it tests for (prompt leakage, instruction override, context truncation, tool-call rewriting, SSE anomalies).

• Share the report with security + platform teams and require a “no HIGH findings” gate before production rollout.

Source-backed notes

• README states it runs a local 13-step audit and outputs a structured Markdown report.
• README lists three runtime profiles: general, web3, and full.
• Quick Start in README uses a standalone audit.py downloaded via curl and executed with Python.

FAQ

• Does it require installing a package?: No — README provides a standalone audit.py you can download and run locally.
• What do I give it?: A provider API key and the relay/proxy base URL; the script runs a predefined audit sequence.
• How often should I run it?: Run before onboarding a relay and re-run after provider updates, config changes, or incidents.