Propose a patch

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

diff --git a/relay/kokochat-relay-connector.mjs b/relay/kokochat-relay-connector.mjs
--- a/relay/kokochat-relay-connector.mjs
+++ b/relay/kokochat-relay-connector.mjs
@@ -136,1 +136,0 @@
-relaySecret: process.env.KOKOCHAT_RELAY_SECRET,
@@ -181,1 +180,0 @@
-relaySecret: state.relaySecret,
@@ -205,1 +203,0 @@
-const relaySecret = stringField(value, "relaySecret");
diff --git a/generate-kokochat-code.mjs b/generate-kokochat-code.mjs
--- a/generate-kokochat-code.mjs
+++ b/generate-kokochat-code.mjs
@@ -311,1 +311,0 @@
-const { relayId, relaySecret } = loadOrCreateRelayCredentials(root, relayUrl);
@@ -312,1 +311,0 @@
-const gatewayUrl = relayGatewayUrl(relayUrl, relayId, relaySecret);
@@ -317,1 +315,0 @@
-relaySecret,
@@ -324,1 +321,0 @@
-function loadOrCreateRelayCredentials(root, relayUrl) {

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 0.4.1. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: kokochat-pairing: Credential pass-through configuration (KillerSkills verdict caution 64)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **CAUTION 64/100**. Summary: static analysis only — behavior not yet observed.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/clawhub/kokochat-pairing/0.4.1

## Findings with a location
- `relay/kokochat-relay-connector.mjs:181` · Credential pass-through configuration — relay/kokochat-relay-connector.mjs:181 · Credential pass-through configuration — agent relays sensitive credentials
- `generate-kokochat-code.mjs:311` · Credential pass-through configuration — generate-kokochat-code.mjs:311 · Credential pass-through configuration — agent relays sensitive credentials
- `relay/kokochat-relay-connector.mjs:136` · Credential pass-through configuration — relay/kokochat-relay-connector.mjs:136 · Credential pass-through configuration — agent relays sensitive credentials
- `generate-kokochat-code.mjs:324` · Credential pass-through configuration — generate-kokochat-code.mjs:324 · Credential pass-through configuration — agent relays sensitive credentials
- `generate-kokochat-code.mjs:317` · Credential pass-through configuration — generate-kokochat-code.mjs:317 · Credential pass-through configuration — agent relays sensitive credentials
- `relay/kokochat-relay-connector.mjs:205` · Credential pass-through configuration — relay/kokochat-relay-connector.mjs:205 · Credential pass-through configuration — agent relays sensitive credentials
- `generate-kokochat-code.mjs:312` · Credential pass-through configuration — generate-kokochat-code.mjs:312 · Credential pass-through configuration — agent relays sensitive credentials

## Proposed change
The attached patch removes the 7 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._