Skirk: an encrypted TCP transport that moves traffic through a Google Drive mailbox

The core idea: a mailbox instead of a socket

Skirk, by ShahabSL, is a Go-first transport for restricted-network testing with an unusual design: instead of opening a direct tunnel, it moves encrypted TCP stream frames through a Google Drive mailbox folder. One side is an exit machine with normal internet egress, ideally a VPS. The other side is a client device exposing a local SOCKS5 proxy, an optional HTTP proxy, or an Android VPN frontend. Between them, traffic rides on Google Drive API calls rather than a raw socket.

The stated purpose is lawful, authorized testing on accounts and networks you own, and the README says so directly, with a disclaimer document to read before using or redistributing the tool. That framing matters: this is a transport engineering project built on an interesting premise, using a cloud storage API as a message-oriented channel, and the interesting question is how far that design can be pushed.

What each side needs

The hardware requirements are minimal: one exit machine with working internet egress, one Google account to own the Drive mailbox, and one generated client profile to distribute. The profile is a single skirk: text line, and clients need no Google login, no gcloud, and no Google Cloud project of their own. The exit setup creates the Google-backed kit once and prints that one-line profile.

Identity handling is split into two layers: each client app creates a local profile identity, and each connection run gets a fresh run identity, so Drive replies route back to the correct device even when several devices import the same profile. That separation is what lets one profile be shared across a laptop, a desktop, and a phone without the mailbox confusing which frames belong to whom.

Setting up the exit

Installation on the exit machine is a one-liner followed by kit creation:

curl -fsSL https://raw.githubusercontent.com/ShahabSL/Skirk/main/install.sh | sh
skirk version
skirk setup init --out skirk-kit --reset-google-login
skirk service status

Setup offers two OAuth paths. Easy mode uses Skirk's built-in OAuth client and prints a Google device URL plus a short code; you open the URL, enter the code, approve Drive access, and the terminal continues. Personal mode instead takes a Google Cloud OAuth client of type Desktop app, so Drive API quota is charged to your own project rather than the shared one. The README compares this to rclone's model: shared OAuth is convenient, personal OAuth isolates quota. On Linux, setup also installs and enables a skirk-exit systemd service, or defers that with a --start-exit=false flag if you only want the config files. An operator menu, launched by running skirk with no arguments, gathers setup, service, cleanup, and revoke actions in one place.

Client surfaces across platforms

Clients come in three shapes. The Go CLI serves headless machines:

skirk serve-client --config client.skirk --listen 127.0.0.1:18080
curl --socks5-hostname 127.0.0.1:18080 http://example.com/

A stable --client-id flag can be set once per device; the README is careful to note it is not a secret, it only separates one device from others sharing the copied profile. Portable desktop apps for Windows, Linux, and macOS import the same one-line profile and start a SOCKS and HTTP sidecar, with Windows adding system proxy and VPN modes, Linux gaining VPN mode under root or CAP_NET_ADMIN, and macOS supporting proxy mode in the current release. An Android app handles the phone case: import the profile, select VPN, connect, and grant VPN consent on first use, with a universal APK as the default choice over per-ABI builds.

Route modes and front pinning

Generated client profiles default to a google_front_pinned route mode, which sends Google API traffic over a Google-looking TLS route pinned to a configured Google edge IP. The exit side defaults to direct routing since it normally has ordinary internet access. Older Linux profiles generated before v0.1.51 are not rewritten on update; you regenerate the kit or pass the route mode and Google IP explicitly when starting the client.

The route system composes with restricted networks that present themselves as a local SOCKS proxy: a --upstream-proxy flag accepts a socks5h URL, chaining the pinned route through the existing proxy. A --route-mode direct flag forces plain Google API routing for baseline throughput checks on normal networks. The design reads as one long study in making Drive API traffic look like exactly what it claims to be, on paths where that claim is true.

Measuring the channel

A transport built on a storage API lives and dies by its latency and quota economics, so the project ships its own measurement tooling:

skirk bench-live --config skirk-kit/client.skirk --samples 5

The bench command measures live latency and throughput against a running exit and estimates Drive API use, which is the number that decides whether the mailbox approach is viable for your workload. Uninstalling is symmetric and dry-run-first, with an uninstall command that previews what it removes before a --yes flag commits it, plus an uninstall path through the install script itself.

Operationally the lifecycle is tidy: install, init a kit with OAuth, start the exit service, copy the profile line, import it on clients, bench the channel, revoke and clean up when done. The README keeps every step in commands rather than screenshots, which suits the Go CLI heritage of the project.

Editorial conclusion

Skirk is a niche tool with a genuinely novel transport: encrypted TCP frames relayed through a Google Drive mailbox, wrapped in an unusually disciplined operational surface with two OAuth modes, per-device and per-run identities, pinned TLS fronts, built-in benchmarking, and dry-run-first uninstall. Its own terms limit it to lawful, authorized use on accounts and networks you own, and within that scope it is a competent study in building a message-oriented channel out of a cloud storage API.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. README
4. Releases
5. ShahabSL/Skirk on GitHub