Flowdriver Covert Transport

If you're behind a firewall that blocks VPNs or inspects SNI headers, this tunnels SOCKS5 traffic through Google Drive API calls. The client uploads request packets as files to a shared folder, the server polls that folder, makes the actual TCP connections, and writes responses back as more files. It's slow (150-300ms polling intervals) and burns through Drive API quota, but the traffic looks like legitimate googleapis.com activity. You'll need OAuth2 credentials and a published Google Cloud app to avoid token expiry. Best for situations where nothing else works and you can tolerate high latency. Not subtle if someone checks your Drive folder, but effective against network-level DPI.

skills.sh installs: 206
GitHub stars: 26
last updated: Jun 3, 2026

View on GitHub

Install

$ npx -y skills add aradotso/trending-skills --skill flowdriver-covert-transport --agent claude-code

Installs into .claude/skills of the current project.

Files

FlowDriver Covert Transport

Skill by ara.so — Daily 2026 Skills collection.

FlowDriver tunnels SOCKS5 proxy traffic through Google Drive API calls, making network traffic appear as legitimate cloud storage activity. It treats a shared Drive folder as a bidirectional data queue: the client uploads binary-encoded request packets, the server polls for them, opens real TCP connections, and returns responses as Drive files.

How It Works

Local App → SOCKS5 → FlowDriver Client → Google Drive Folder → FlowDriver Server → Internet
                      (upload requests)   (shared queue)        (download + proxy)

Client listens on a local SOCKS5 port, encodes TCP requests into a binary protocol, and uploads them to a Drive folder.
Server polls the same folder, downloads request files, opens real TCP connections to destinations, and uploads response files back.
Traffic appears as normal googleapis.com API calls — resilient against SNI-based and DPI filtering.