Propose a patch

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

diff --git a/errors.md b/errors.md
--- a/errors.md
+++ b/errors.md
@@ -105,1 +105,0 @@
-… with a message about types. **After diagnosing a non-obvious parse failure**, write one row to `## Gotchas Hit` in `~/Clawic/data/yaml/memory.md`: the message, the real cause, the file, and the fix (`memory-template.md`). Er…
diff --git a/dialects.md b/dialects.md
--- a/dialects.md
+++ b/dialects.md
@@ -88,1 +88,0 @@
-… quirk is diagnosed or a tool-specific file becomes part of the user's setup**, add or update its row in `## Config Files` of `~/Clawic/data/yaml/memory.md` (path, tool, spec version, validator, whether it is templated or rewritten by …
diff --git a/editing.md b/editing.md
--- a/editing.md
+++ b/editing.md
@@ -118,1 +118,0 @@
-…on, and add its `## Boxes` line in the same turn (`memory-template.md`). If the edit revealed a house style, that goes to `## Repo Style` in `memory.md`; if the user declared the style, it goes to `config.yaml`. 
diff --git a/SKILL.md b/SKILL.md
--- a/SKILL.md
+++ b/SKILL.md
@@ -40,1 +40,0 @@
-…-tls`, `1password:Work/Cluster/kubeconfig`, `sops:secrets/prod.enc.yaml`, `file:~/.kube/config`. A pasted PEM key inside a `|` block is the single most common way a secret la…
diff --git a/schemas.md b/schemas.md
--- a/schemas.md
+++ b/schemas.md
@@ -112,1 +112,0 @@
-…e>.md` (or its location, if it lives in the repo), add its `## Boxes` line, and update the affected rows of `## Config Files` in `~/Clawic/data/yaml/memory.md` with which validator now guards them (`memory-template.md`). If a re-validatio…
diff --git a/parsers.md b/parsers.md
--- a/parsers.md
+++ b/parsers.md
@@ -109,1 +109,0 @@
-…** — or after any behavior above turns out to differ on the installed version — write or update its row in `## Toolchain` of `~/Clawic/data/yaml/memory.md`: project, library, version, spec version, and the quirk that was observed (`me…
diff --git a/types.md b/types.md
--- a/types.md
+++ b/types.md
@@ -119,1 +119,0 @@
-…e fails in CI instead of at runtime. **After a coercion trap actually bites**, write it to `## Gotchas Hit` in `~/Clawic/data/yaml/memory.md` — the value, the file, the parser, and the fix — and if the parser or spec ver…
diff --git a/multiline.md b/multiline.md
--- a/multiline.md
+++ b/multiline.md
@@ -111,1 +111,0 @@
-…yaml/artifacts/<kebab-name>.md`, with every secret replaced by its pointer, and add its `## Boxes` line to `memory.md` in the same turn (`memory-template.md`). Deriving the right header takes two o…
diff --git a/pipelines.md b/pipelines.md
--- a/pipelines.md
+++ b/pipelines.md
@@ -80,1 +80,0 @@
-…at runs **When a pipeline trap is diagnosed or a workflow layout is settled**, write it down: the trap goes as one row in `## Gotchas Hit` of `~/Clawic/data/yaml/memory.md` with the verbatim error, the workflow file gets or updates its row in `## Conf…
diff --git a/kubernetes.md b/kubernetes.md
--- a/kubernetes.md
+++ b/kubernetes.md
@@ -102,1 +102,0 @@
-…to `~/Clawic/data/yaml/artifacts/<kebab-name>.md` with its `## Boxes` line, and update the file's row in `## Config Files` of `~/Clawic/data/yaml/memory.md` (`memory-template.md`). Never copy Secret payloads or kubeconfig material into…

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 1.0.2. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: yaml: Instructs the agent to modify its persistent memory or instruction files (KillerSkills verdict caution 65)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **CAUTION 65/100**. Summary: static analysis only — behavior not yet observed.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/clawhub/yaml/1.0.2

## Findings with a location
- `errors.md:105` · Instructs the agent to modify its persistent memory or instruction files — errors.md:105 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `dialects.md:88` · Instructs the agent to modify its persistent memory or instruction files — dialects.md:88 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `editing.md:118` · Instructs the agent to modify its persistent memory or instruction files — editing.md:118 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `SKILL.md:40` · References a credential file in the home directory — SKILL.md:40 · References a credential file in the home directory
- `schemas.md:112` · Instructs the agent to modify its persistent memory or instruction files — schemas.md:112 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `parsers.md:109` · Instructs the agent to modify its persistent memory or instruction files — parsers.md:109 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `types.md:119` · Instructs the agent to modify its persistent memory or instruction files — types.md:119 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `multiline.md:111` · Instructs the agent to modify its persistent memory or instruction files — multiline.md:111 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `pipelines.md:80` · Instructs the agent to modify its persistent memory or instruction files — pipelines.md:80 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `kubernetes.md:102` · Instructs the agent to modify its persistent memory or instruction files — kubernetes.md:102 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file

## Proposed change
The attached patch removes the 10 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._