[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-76338":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":14,"contributorsCount":15,"subscribersCount":15,"size":15,"stars1d":14,"stars7d":16,"stars30d":17,"stars90d":15,"forks30d":15,"starsTrendScore":18,"compositeScore":19,"rankGlobal":9,"rankLanguage":9,"license":20,"archived":21,"fork":21,"defaultBranch":22,"hasWiki":21,"hasPages":21,"topics":23,"createdAt":9,"pushedAt":9,"updatedAt":24,"readmeContent":25,"aiSummary":26,"trendingCount":15,"starSnapshotCount":15,"syncStatus":13,"lastSyncTime":27,"discoverSource":28},76338,"Skirk","ShahabSL\u002FSkirk","ShahabSL","Socks over Google Drive.",null,"Go",787,93,2,13,0,16,634,39,9.92,"MIT License",false,"main",[],"2026-06-12 02:03:41","# Skirk\n\n[فارسی](README.fa.md)\n\n\u003Cp align=\"center\">\n  \u003Cimg src=\"assets\u002Flogo.png\" alt=\"Skirk logo\" width=\"160\">\n\u003C\u002Fp>\n\n## Donate\n\nIf Skirk is useful to you, donations help fund testing infrastructure and\nmaintenance:\n\n- USDT: `0x5d0b46d821910a5a5503de78e230f9a5e9c52c2f`\n- BTC: `bc1q8qsxlp7pzgdqkhu2aj5ss3krnkrecyrh6hedpj`\n- ETH: `0x5d0b46d821910a5a5503de78e230f9a5e9c52c2f`\n- TON: `UQAO9dEwEVIrrTwoWzCd3Rksb6r3qFSs80Xa7yp3nkO4CPyp`\n\nSkirk is a Go-first transport for restricted-network testing. It exposes a local\nSOCKS5 proxy, optional HTTP proxy, or Android VPN frontend, then moves encrypted\nTCP stream frames through a Google Drive mailbox folder to an exit\nmachine with normal internet egress.\n\nSkirk is for lawful, authorized, owned-account and owned-network use only. It is\nnot affiliated with or endorsed by Google, Google Cloud, Google Drive,\nCloudflare, GitHub, Microsoft, Android, or any other provider. Read\n[DISCLAIMER.md](DISCLAIMER.md) before using or redistributing it.\n\n## What You Need\n\n- One exit machine with working internet egress. A VPS is best for uptime, but a\n  laptop or home server works while it stays online.\n- One Google account for the Drive mailbox.\n- One generated `skirk:...` client profile to share with client devices.\n\nClients do not need Google login, `gcloud`, or a Google Cloud project. The exit\nsetup creates the Google-backed kit once and prints a one-line client profile.\nThe same profile can be imported on multiple devices. Each client app creates a\nlocal profile identity, and each connection run gets a fresh run identity, so\nDrive replies are routed back to the correct device.\n\n## Quick Start\n\nInstall Skirk on the exit machine:\n\n```bash\ncurl -fsSL https:\u002F\u002Fraw.githubusercontent.com\u002FShahabSL\u002FSkirk\u002Fmain\u002Finstall.sh | sh\nexport PATH=\"$HOME\u002F.local\u002Fbin:$PATH\"\n\"$HOME\u002F.local\u002Fbin\u002Fskirk\" version\n```\n\nCreate a kit and start the exit service:\n\n```bash\n\"$HOME\u002F.local\u002Fbin\u002Fskirk\" setup init --out skirk-kit --reset-google-login\n```\n\nInteractive setup first lets you choose easy Skirk OAuth or a personal Google\nOAuth project. Easy mode prints a Google device URL plus a short code; open the\nURL, enter the code in the browser, approve Drive access, and the terminal\ncontinues.\nOn Linux, setup also installs\u002Fenables `skirk-exit.service` and starts the exit\nimmediately. Use `--start-exit=false` if you only want the config files.\n\nBy default this uses Skirk's built-in OAuth client for the easiest install.\nHeavy users can instead use their own Google Cloud OAuth client so Drive API\ntraffic is charged to their own project quota:\n\n```bash\n\"$HOME\u002F.local\u002Fbin\u002Fskirk\" setup init --out skirk-kit --reset-google-login --oauth-mode personal\n```\n\nFor personal OAuth, create a Google OAuth client with application type\n`Desktop app`, paste its client ID and client secret, approve the printed Google\nURL, then paste the redirected localhost URL back into the VPS terminal if the\nbrowser cannot reach it locally.\n\nThis is the same operational model used by tools such as rclone: shared OAuth\nis convenient, personal OAuth isolates quota.\n\nCheck the exit service:\n\n```bash\n\"$HOME\u002F.local\u002Fbin\u002Fskirk\" service status\n```\n\nOr run the operator menu and choose setup, service, cleanup, or revoke actions\nfrom one place:\n\n```bash\n\"$HOME\u002F.local\u002Fbin\u002Fskirk\"\n```\n\nUninstall from Linux:\n\n```bash\n\"$HOME\u002F.local\u002Fbin\u002Fskirk\" uninstall --dry-run\n\"$HOME\u002F.local\u002Fbin\u002Fskirk\" uninstall --yes\n# or:\ncurl -fsSL https:\u002F\u002Fraw.githubusercontent.com\u002FShahabSL\u002FSkirk\u002Fmain\u002Finstall.sh | sh -s -- uninstall\n```\n\nIf you generated a kit with `--start-exit=false`, start the exit manually or\ninstall the service later:\n\n```bash\n\"$HOME\u002F.local\u002Fbin\u002Fskirk\" service install --config skirk-kit\u002Fexit.json\n\"$HOME\u002F.local\u002Fbin\u002Fskirk\" service status\n```\n\nCopy the one-line text from `skirk-kit\u002Fclient.skirk` and use it on a client.\nFrom a Linux client:\n\n```bash\ncurl -fsSL https:\u002F\u002Fraw.githubusercontent.com\u002FShahabSL\u002FSkirk\u002Fmain\u002Finstall.sh | sh\nexport PATH=\"$HOME\u002F.local\u002Fbin:$PATH\"\n\nread -r SKIRK_CLIENT_CONFIG\n# paste the skirk:... profile, press Enter, then run:\n\"$HOME\u002F.local\u002Fbin\u002Fskirk\" serve-client --config \"$SKIRK_CLIENT_CONFIG\" --listen 127.0.0.1:18080\n```\n\nTest the local SOCKS proxy:\n\n```bash\ncurl --socks5-hostname 127.0.0.1:18080 http:\u002F\u002Fexample.com\u002F\n```\n\nUse `socks5h` behavior in apps that support it so DNS resolution happens through\nthe Skirk exit path.\n\n## Client Options\n\nLinux and headless servers use the Go CLI:\n\n```bash\nskirk serve-client --config client.skirk --listen 127.0.0.1:18080\n```\n\nFor a long-lived Linux install, set a stable local client ID once. This is not a\nsecret; it only separates this device from other devices using the same copied\nprofile:\n\n```bash\nskirk serve-client --config client.skirk --listen 127.0.0.1:18080 --client-id my-laptop\n```\n\nWindows users should use the portable desktop app from the release assets. It\nimports the same one-line `skirk:` profile and starts the Skirk SOCKS sidecar.\nThe Windows build is proxy-first; configure the browser or app to use SOCKS5\n`127.0.0.1:18080`.\n\nAndroid users should use the Android app. Import the same one-line profile,\nselect `VPN`, and tap `Connect`. Android asks for VPN consent on first use.\n`Proxy` mode is available when an app or another LAN device explicitly supports\nSOCKS5.\n\nCurrent client surfaces:\n\n| Android | Windows desktop |\n| --- | --- |\n| \u003Cimg src=\"assets\u002Fclients\u002Fandroid-client.png\" alt=\"Skirk Android client in VPN mode\" width=\"260\"> | \u003Cimg src=\"assets\u002Fclients\u002Fwindows-desktop.png\" alt=\"Skirk Windows desktop client connection console\" width=\"620\"> |\n\nSee [docs\u002Fclients.md](docs\u002Fclients.md) for build and release details.\n\n## Restricted-Network Testing\n\nGenerated client profiles default to `google_front_pinned`, which uses a\nGoogle-looking TLS route pinned to the configured Google edge IP for Google API\ntraffic. The exit defaults to `direct` because it normally has ordinary internet\naccess.\n\nExisting Linux profiles generated before v0.1.51 are not rewritten by an\nupdate. Regenerate the kit or pass\n`--route-mode google_front_pinned --google-ip 216.239.38.120` when starting the\nclient.\n\nIf the restricted network is exposed locally as another SOCKS proxy:\n\n```bash\nskirk serve-client \\\n  --config \"$SKIRK_CLIENT_CONFIG\" \\\n  --listen 127.0.0.1:18080 \\\n  --route-mode google_front_pinned \\\n  --upstream-proxy socks5h:\u002F\u002F127.0.0.1:11093\n```\n\nFor normal-network throughput checks, omit `--upstream-proxy`. You can also\nforce direct Google API routing:\n\n```bash\nskirk serve-client --config \"$SKIRK_CLIENT_CONFIG\" --listen 127.0.0.1:18080 --route-mode direct\n```\n\n## Benchmark And Logs\n\nWith the exit running, measure live latency, throughput, and estimated Drive API\nuse:\n\n```bash\nskirk bench-live --config skirk-kit\u002Fclient.skirk --samples 5\n```\n\nMeasure a hostile path:\n\n```bash\nskirk bench-live \\\n  --config skirk-kit\u002Fclient.skirk \\\n  --upstream-proxy socks5h:\u002F\u002F127.0.0.1:11093 \\\n  --route-mode google_front_pinned \\\n  --samples 3\n```\n\nAdd a bulk URL when you want throughput:\n\n```bash\nskirk bench-live --config skirk-kit\u002Fclient.skirk --bulk-url http:\u002F\u002Fexample.com\u002Fbig.bin\n```\n\nRuntime logs include per-minute Drive operation counts, estimated quota units,\nerrors, response bytes, and operation timing. Google Cloud Console metrics are\nthe project-level source of truth when using your own OAuth client\u002Fproject.\n\n## Runtime Shape\n\nSkirk's production runtime uses a prefix-scoped Drive mailbox with fresh object\nlisting. That path is intentionally simple: upload encrypted mux objects, poll the\nmatching direction prefix, download by Drive file ID, and delete processed\nobjects after foreground traffic is quiet.\n\nMux v4 is the current default for Skirk's Drive-only transport. In local\nsame-day mixed-workload tests, it has been more reliable than the experimental\ncandidates tried so far, especially when browser or media traffic overlaps bulk\ndownloads. It is still bounded by Drive upload, object visibility, prefix\nlisting, download, cleanup, quota, and route conditions, so benchmark results are\nenvironment-specific rather than guaranteed speed claims.\n\nThe Linux installer can perform VPS setup non-interactively:\n\n```bash\ncurl -fsSL https:\u002F\u002Fraw.githubusercontent.com\u002FShahabSL\u002FSkirk\u002Fmain\u002Finstall.sh | \\\n  SKIRK_SERVER_SETUP=1 \\\n  sh\n```\n\nClients still use the Google-fronted Drive path and do not need inbound\nconnectivity.\n\n## Cleanup And Disconnect\n\nNormal runtime deletes processed mailbox objects. `serve-exit` also starts a\nconservative automatic janitor at startup and then every 2 minutes. It deletes\nstale Skirk transport objects older than 10 minutes with low delete concurrency,\nso long VPN or multi-client sessions cannot starve stale-object cleanup\nindefinitely.\n\nManual cleanup is dry-run by default:\n\n```bash\nskirk cleanup --config skirk-kit\u002Fexit.json --older-than 2h\n```\n\nActually delete matching stale objects:\n\n```bash\nskirk cleanup --config skirk-kit\u002Fexit.json --older-than 2h --delete\n```\n\nEmpty every object in the configured Skirk mailbox:\n\n```bash\nskirk cleanup --config skirk-kit\u002Fexit.json --all --older-than 1ns --delete --max-pages 20000\n```\n\nIf the Drive mailbox folder was deleted or the exit reports `drive_not_found`,\nrepair the kit and restart the exit service:\n\n```bash\nskirk repair-mailbox --kit skirk-kit --start-exit\n```\n\nRevoke the OAuth token embedded in a generated config:\n\n```bash\nskirk revoke --config skirk-kit\u002Fexit.json --revoke-oauth\n```\n\nThen delete local generated files:\n\n```bash\nrm -rf skirk-kit\n```\n\nIf a client profile leaks, revoke OAuth access and generate a new kit. Treat\n`client.skirk`, `client.json`, and `exit.json` like passwords.\n\n## Advanced\n\nForward exit traffic through another proxy, such as a local WARP\u002Fwireproxy\nSOCKS listener:\n\n```bash\nskirk serve-exit --config skirk-kit\u002Fexit.json --exit-proxy socks5h:\u002F\u002F127.0.0.1:40000\n```\n\nFor a clean VPS install that should create the WARP wireproxy service, write the\nexit proxy into the generated config and start the exit service:\n\n```bash\ncurl -fsSL https:\u002F\u002Fraw.githubusercontent.com\u002FShahabSL\u002FSkirk\u002Fmain\u002Finstall.sh | \\\n  SKIRK_SERVER_SETUP=1 \\\n  SKIRK_INSTALL_SYSTEMD=1 \\\n  SKIRK_INSTALL_WIREPROXY=1 \\\n  SKIRK_ACCEPT_WARP_TOS=1 \\\n  sh\n```\n\nThe managed WARP listener is loopback-only by design. Use a custom\n`--exit-proxy` or `SKIRK_EXIT_PROXY` for an already-secured outbound proxy.\n\nExpose an HTTP\u002FHTTPS proxy on the client in addition to SOCKS5:\n\n```bash\nskirk serve-client \\\n  --config skirk-kit\u002Fclient.skirk \\\n  --listen 127.0.0.1:18080 \\\n  --http-proxy-listen 127.0.0.1:18081\n```\n\nSkirk uses prefix-scoped fresh listing for runtime object discovery. The main\nlatency knob exposed to clients is `--poll-ms`; lower values trade more Drive API\ncalls for faster wakeups.\n\n## Documentation\n\n- [Install Guide](docs\u002Finstall.md)\n- [Setup Guide](docs\u002Fsetup.md)\n- [Client Guide](docs\u002Fclients.md)\n- [Architecture](docs\u002Farchitecture.md)\n- [Transport Modes](docs\u002Fskirk_modes.md)\n- [Transport Research](docs\u002Ftransport-research.md)\n- [Go CLI Notes](docs\u002Fgo_skirk.md)\n- [Development Guide](docs\u002Fdevelopment.md)\n- [Release Guide](docs\u002Frelease.md)\n- [Security Policy](SECURITY.md)\n- [Legal Disclaimer](DISCLAIMER.md)\n","Skirk 是一个通过 Google Drive 传输加密数据的工具，主要用于受限网络环境下的测试。它支持本地 SOCKS5 代理、可选的 HTTP 代理或 Android VPN 前端，并将加密的 TCP 流帧通过 Google Drive 邮箱文件夹传递到具有正常互联网出口的出口机器上。该项目使用 Go 语言编写，具有良好的跨平台兼容性和安全性。适用于需要绕过网络限制进行合法授权测试的场景，如企业内部网络测试、开发者调试等。请注意，使用 Skirk 必须遵守相关法律法规和使用条款。","2026-06-11 03:54:56","CREATED_QUERY"]