Propose a patch

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

diff --git a/debug.md b/debug.md
--- a/debug.md
+++ b/debug.md
@@ -117,1 +117,0 @@
-…set wants (`evaluation.md`). **After diagnosing a failure down to its cause**, add a row to `## Known Failures` in `~/Clawic/data/rag/memory.md` — date, symptom, the real cause, the fix, and whether it is still open — and k…
diff --git a/costs.md b/costs.md
--- a/costs.md
+++ b/costs.md
@@ -125,1 +125,0 @@
-…replaced last quarter and still billing | **After a cost review or a saving**, write the cost per query and its date into `## Baseline` in `~/Clawic/data/rag/memory.md`, and the saving with what it cost in quality into `~/Clawic/data/rag/evals/<ye…
diff --git a/ingestion.md b/ingestion.md
--- a/ingestion.md
+++ b/ingestion.md
@@ -110,1 +110,0 @@
-…rsions are live (SKILL.md Rule 8). **After ingesting or re-parsing a source**, write its row to `## Corpus` in `~/Clawic/data/rag/memory.md` — source, format, document count, refresh cadence, owner, access field — and, …
diff --git a/retrieval.md b/retrieval.md
--- a/retrieval.md
+++ b/retrieval.md
@@ -103,1 +103,0 @@
-…o `~/Clawic/data/rag/evals/<year>.md` naming the one variable that changed, and update the retrieval configuration in `## Index Registry` in `memory.md` — fusion method, `α` if fitted, boosts, MMR `λ`, threshold and the date it was…
diff --git a/multimodal.md b/multimodal.md
--- a/multimodal.md
+++ b/multimodal.md
@@ -91,1 +91,0 @@
-…ver the retrieval quality is comparable. **After building a multimodal path**, add the image-bearing sources to `## Corpus` in `~/Clawic/data/rag/memory.md` with their category and the description model used, record the description pro…
diff --git a/indexing.md b/indexing.md
--- a/indexing.md
+++ b/indexing.md
@@ -122,1 +122,0 @@
-…he wrong stage. **After building, resizing, repointing or retiring an index**, write its row to `## Index Registry` in `~/Clawic/data/rag/memory.md` — store, index parameters, quantization, chunk count, build date — and put the…
diff --git a/production.md b/production.md
--- a/production.md
+++ b/production.md
@@ -138,1 +138,0 @@
-…Clawic/data/rag/evals/<year>.md` (the golden-set run that gated the switch) and update `## Index Registry` in `memory.md` with the new index and a retirement date on the old row. Save the reindex proc…
diff --git a/structured-data.md b/structured-data.md
--- a/structured-data.md
+++ b/structured-data.md
@@ -94,1 +94,0 @@
-…enance cost, and what was rejected — plus its `## Boxes` line in the same turn. Add the SQL schema source or the graph store to `## Corpus` in `memory.md` as its own row with its refresh cadence, and put a self-hosted graph or analyt…
diff --git a/embeddings.md b/embeddings.md
--- a/embeddings.md
+++ b/embeddings.md
@@ -100,1 +100,0 @@
-…6 GB index into a capacity project. **After building or repointing an index**, write its row to `## Index Registry` in `~/Clawic/data/rag/memory.md` with all six fingerprint fields, the chunker, the chunk count and the build da…

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 1.0.2. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: rag: Instructs the agent to modify its persistent memory or instruction files (KillerSkills verdict caution 72)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **CAUTION 72/100**. Summary: static analysis only — behavior not yet observed.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/clawhub/rag/1.0.2

## Findings with a location
- `debug.md:117` · Instructs the agent to modify its persistent memory or instruction files — debug.md:117 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `costs.md:125` · Instructs the agent to modify its persistent memory or instruction files — costs.md:125 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `ingestion.md:110` · Instructs the agent to modify its persistent memory or instruction files — ingestion.md:110 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `retrieval.md:103` · Instructs the agent to modify its persistent memory or instruction files — retrieval.md:103 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `multimodal.md:91` · Instructs the agent to modify its persistent memory or instruction files — multimodal.md:91 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `indexing.md:122` · Instructs the agent to modify its persistent memory or instruction files — indexing.md:122 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `production.md:138` · Instructs the agent to modify its persistent memory or instruction files — production.md:138 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `structured-data.md:94` · Instructs the agent to modify its persistent memory or instruction files — structured-data.md:94 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `embeddings.md:100` · Instructs the agent to modify its persistent memory or instruction files — embeddings.md:100 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file

## Proposed change
The attached patch removes the 9 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._