Time on the project has been limited over the past week but an hour here and there has seen the basic Proxy functionality implemented, at last. There have been a few attempts at this and efforts have been tempered by discussions at forums.slimdevices.com around security.
The Alexa skill companion LMS plug-in now has an in-built proxy. Users can configure the port they wish to open and the skill will communicate directly with the proxy. Critically, no direct inbound requests for LMS commands are supported. They only inbound request over HTTP is a simple notification advising that the skill has a command it wishes to issue. The plug-in then initiates a connection over HTTPS, retrieves and processes the command and returns the response, all over a secure connection.
The advantage of this approach is that all LMS queries are handled locally between the plug-in and the LMS itself. An additional layer of code is implemented to verify that the command belongs to a permitted sub-set of basic commands implemented in the skill. The downside is potential delays caused by increased communications per transaction between the plug-in and the skill. Testing will be required to determine the full impact
There's still a long way to go with this element of the project as I need to now go back and clean up all the code and add in a bunch of error checking and reporting but basically, it works!