Propose a patch

A fix the maintainer can act on, with the evidence attached. It opens under your GitHub account in your browser; KillerSkills holds no token and never modifies the package. The fix is verified the only way we verify anything: the next crawl re-runs the new version in the honeypot. 71 · Caution

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

Diff · removes 13 caught lines

Download .patch

diff --git a/references/init-agents.md b/references/init-agents.md
--- a/references/init-agents.md
+++ b/references/init-agents.md
@@ -12,1 +12,0 @@
-If AGENTS.md exists: warn user, suggest update workflow instead. Allow override with `--force`.
@@ -14,1 +13,0 @@
-If CLAUDE.md exists but AGENTS.md doesn't: migrate (rename to AGENTS.md; add a CLAUDE.md symlink only if a harness or session needs it, per [Claude Code compatibility](#claude-code-compatibility)).
@@ -25,1 +23,0 @@
-| `CLAUDE.local.md` or a real `CLAUDE.md` present | AGENTS.md is not loaded. Either add a CLAUDE.md next to AGENTS.md containing `@AGENTS.md` (or put the import at the top of an existing CLAUDE.md in 
@@ -26,1 +23,0 @@
-| Claude Code before v2.1.277, built-in `agents-md` plugin disabled, first session after upgrading from v2.1.276 or earlier, or (before v2.1.281) some Bedrock or telemetry-disabled sessions | Only CLA
@@ -30,1 +26,0 @@
-Native loading differs from a symlink or import in two places: `InstructionsLoaded` hooks do not fire for a natively read AGENTS.md (they do fire through a CLAUDE.md symlink or `@AGENTS.md` import), a
diff --git a/references/documentation-workflows.md b/references/documentation-workflows.md
--- a/references/documentation-workflows.md
+++ b/references/documentation-workflows.md
@@ -7,1 +7,0 @@
-Verify and fix AGENTS.md against the actual codebase. See [update-agents.md](./update-agents.md) for the full verification workflow.
@@ -38,1 +37,0 @@
-If `DOCS.md` exists, treat it as API-level documentation (endpoints, function signatures, type definitions). Verify against actual code the same way as AGENTS.md. Never auto-create DOCS.md; only updat
@@ -52,1 +50,0 @@
-3. Write AGENTS.md; create the CLAUDE.md symlink only when needed (optional, see [init-agents.md](./init-agents.md#claude-code-compatibility))
diff --git a/skill-card.md b/skill-card.md
--- a/skill-card.md
+++ b/skill-card.md
@@ -40,1 +40,0 @@
-- [Update AGENTS.md](references/update-agents.md)
diff --git a/SKILL.md b/SKILL.md
--- a/SKILL.md
+++ b/SKILL.md
@@ -25,1 +25,0 @@
-AGENTS.md is the universal context file (works with Claude Code, Codex, Kilocode). During Initialize Context or Update Context Files workflows only: if CLAUDE.md exists without AGENTS.md, confirm with
@@ -84,1 +83,0 @@
-- [update-agents.md](./references/update-agents.md).
diff --git a/references/monorepo.md b/references/monorepo.md
--- a/references/monorepo.md
+++ b/references/monorepo.md
@@ -57,1 +57,0 @@
-**Codex:** [documented startup discovery](https://learn.chatgpt.com/docs/agent-configuration/agents-md) follows the project-root-to-working-directory chain; deeper instruction files are outside that c
diff --git a/SPEC.md b/SPEC.md
--- a/SPEC.md
+++ b/SPEC.md
@@ -5,1 +5,0 @@
-`ia-md-docs` is a `workflow`-class skill (a multi-step process producing concrete artifacts). Manages project documentation: CLAUDE.md, AGENTS.md, README.md, CONTRIBUTING.md. Use when asked to update,

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 5.1.5. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: compound-eng-md-docs: Instructs the agent to modify its persistent memory or instruction files (KillerSkills verdict caution 71)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **CAUTION 71/100**. Summary: static analysis only — behavior not yet observed.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/clawhub/compound-eng-md-docs/5.1.5

## Findings with a location
- `references/init-agents.md:26` · Instructs the agent to modify its persistent memory or instruction files — references/init-agents.md:26 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informationa
- `references/init-agents.md:30` · Instructs the agent to modify its persistent memory or instruction files — references/init-agents.md:30 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informationa
- `references/documentation-workflows.md:38` · Instructs the agent to modify its persistent memory or instruction files — references/documentation-workflows.md:38 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · 
- `references/init-agents.md:12` · Instructs the agent to modify its persistent memory or instruction files — references/init-agents.md:12 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informationa
- `skill-card.md:40` · Instructs the agent to modify its persistent memory or instruction files — skill-card.md:40 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informational: not an in
- `references/documentation-workflows.md:7` · Instructs the agent to modify its persistent memory or instruction files — references/documentation-workflows.md:7 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · i
- `SKILL.md:84` · Instructs the agent to modify its persistent memory or instruction files — SKILL.md:84 · Instructs the agent to modify its persistent memory or instruction files
- `SKILL.md:25` · Instructs the agent to modify its persistent memory or instruction files — SKILL.md:25 · Instructs the agent to modify its persistent memory or instruction files
- `references/init-agents.md:14` · Instructs the agent to modify its persistent memory or instruction files — references/init-agents.md:14 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informationa
- `references/monorepo.md:57` · Instructs the agent to modify its persistent memory or instruction files — references/monorepo.md:57 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informational: 
- `references/init-agents.md:25` · Instructs the agent to modify its persistent memory or instruction files — references/init-agents.md:25 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informationa
- `references/documentation-workflows.md:52` · Instructs the agent to modify its persistent memory or instruction files — references/documentation-workflows.md:52 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · 

## Proposed change
The attached patch removes the 13 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._

No GitHub source is recorded for this package, so there is nothing to open; paste the body into the registry's support channel.

We count proposals opened, not merged: a merge shows up as a new version that the crawl re-runs. Disputes: the maintainer can contest the verdict from its page; a person reviews it and the outcome is published.