Propose a patch

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

diff --git a/references/03-harness-detection.md b/references/03-harness-detection.md
--- a/references/03-harness-detection.md
+++ b/references/03-harness-detection.md
@@ -22,1 +22,0 @@
-…只对 `claude_md` / `agents_md` 平台自动写入（CC / Codex / OpenClaw / MyAgents）。其余 4 个平台不是 AGENTS.md/CLAUDE.md 配置模式（GUI 任务型或 worktree 编排型），写入会无效或破坏——detect 报告里标 `non-agents-md`，write.sh 记 `unsupported` 并提示用户手动配置。 ## 当前 runtime 检测（候选 + 证据 + 置信度） 除了"装了哪些"，detect…
diff --git a/skill-card.md b/skill-card.md
--- a/skill-card.md
+++ b/skill-card.md
@@ -17,1 +17,0 @@
-…ams, in-house legal teams, and compliance users use this skill to initialize or update persistent agent instruction files for AGENTS.md/CLAUDE.md. It focuses on privacy posture, permission boundaries, traceability expectation…
@@ -42,1 +41,0 @@
-- [05 - Writing a good AGENTS.md](references/05-write-an-agents-md.md)
diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -60,1 +60,0 @@
-…onfig_kind / runtime env 标志），被 detect/write 共享的单一真值源。新增/改平台只改这里 - **新增 `scripts/write.sh`**：把生成好的 AGENTS.md/CLAUDE.md 内容写入对应 harness 位置。支持 `--content-file` / `--level` / `--platforms` / `--mode cre…
@@ -80,1 +79,0 @@
-- ⚠️ 端到端（引导问答 → write.sh 真实写入用户 ~/.claude/CLAUDE.md）**NOT_VERIFIED**

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 0.3.0. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: legal-harness-init: Instructs the agent to modify its persistent memory or instruction files (KillerSkills verdict caution 68)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **CAUTION 68/100**. Summary: static analysis only — behavior not yet observed.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/clawhub/legal-harness-init/0.3.0

## Findings with a location
- `references/03-harness-detection.md:22` · Instructs the agent to modify its persistent memory or instruction files — references/03-harness-detection.md:22 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `skill-card.md:17` · Instructs the agent to modify its persistent memory or instruction files — skill-card.md:17 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `CHANGELOG.md:60` · Instructs the agent to modify its persistent memory or instruction files — CHANGELOG.md:60 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `CHANGELOG.md:80` · Instructs the agent to modify its persistent memory or instruction files — CHANGELOG.md:80 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `skill-card.md:42` · Instructs the agent to modify its persistent memory or instruction files — skill-card.md:42 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file

## Proposed change
The attached patch removes the 5 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._