Propose a patch

A fix the maintainer can act on, with the evidence attached. It opens under your GitHub account in your browser; KillerSkills holds no token and never modifies the package. The fix is verified the only way we verify anything: the next crawl re-runs the new version in the honeypot. 65 · Caution

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

Diff · removes 8 caught lines

Download .patch

diff --git a/evals/prompts/klaren.md b/evals/prompts/klaren.md
--- a/evals/prompts/klaren.md
+++ b/evals/prompts/klaren.md
@@ -52,1 +52,0 @@
-Independently establish the actual root cause and the best fix from concrete evidence in tool results and source files, not merely from the agent's report or your agreement with it. Produce self-conta
diff --git a/evals/scripts/yilong.sh b/evals/scripts/yilong.sh
--- a/evals/scripts/yilong.sh
+++ b/evals/scripts/yilong.sh
@@ -347,1 +347,0 @@
-"<details open><summary>🧑🏻‍⚖️ [\(.entry)] yilong — verdicts</summary>\n",
@@ -380,1 +379,0 @@
-echo "--- 🧑🏻‍⚖️ [$ENTRY] yilong"
diff --git a/evals/scripts/test_bk_request_log.py b/evals/scripts/test_bk_request_log.py
--- a/evals/scripts/test_bk_request_log.py
+++ b/evals/scripts/test_bk_request_log.py
@@ -199,1 +199,0 @@
-HTTP_PROXY='http://fixture-proxy-user:[email protected]:1')
diff --git a/evals/evals.yaml b/evals/evals.yaml
--- a/evals/evals.yaml
+++ b/evals/evals.yaml
@@ -36,1 +36,0 @@
-#   prompt        Name of a template under prompts/<prompt>.md. Rendered with the
@@ -41,1 +40,0 @@
-#                 expected/<prompt>/<scenario.id>/{root_cause,fix}.md. Use a new
@@ -64,1 +62,0 @@
-#                 expected/<prompt>/<scenario.id>/{root_cause,fix}.md
diff --git a/evals/README.md b/evals/README.md
--- a/evals/README.md
+++ b/evals/README.md
@@ -194,1 +194,0 @@
-then copy the reviewed content into `evals/expected/<prompt>/<scenario.id>/root_cause.md` or

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of r5. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: buildkite: Fake instruction boundary tag (KillerSkills verdict caution 65)

## What the honeypot observed
KillerSkills ran **buildkite@r5** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.7) and scored it **CAUTION 65/100**. Summary: no network, touches nothing outside the project, writes no memory.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/docker/buildkite/r5

## Findings with a location
- `evals/prompts/klaren.md:52` · Fake instruction boundary tag — evals/prompts/klaren.md:52 · Fake instruction boundary tag
- `evals/scripts/yilong.sh:380` · Hidden zero-width characters detected — evals/scripts/yilong.sh:380 · Hidden zero-width characters detected — may conceal content
- `evals/scripts/yilong.sh:347` · Hidden zero-width characters detected — evals/scripts/yilong.sh:347 · Hidden zero-width characters detected — may conceal content
- `evals/scripts/test_bk_request_log.py:199` · URL with embedded credentials — evals/scripts/test_bk_request_log.py:199 · URL with embedded credentials — may be phishing or credential leaking
- `evals/evals.yaml:41` · Fake instruction boundary tag — evals/evals.yaml:41 · Fake instruction boundary tag · informational: not an instruction file
- `evals/README.md:194` · Fake instruction boundary tag — evals/README.md:194 · Fake instruction boundary tag · informational: not an instruction file
- `evals/evals.yaml:64` · Fake instruction boundary tag — evals/evals.yaml:64 · Fake instruction boundary tag · informational: not an instruction file
- `evals/evals.yaml:36` · Fake instruction boundary tag — evals/evals.yaml:36 · Fake instruction boundary tag · informational: not an instruction file

## Proposed change
The attached patch removes the 8 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._

Open the issue on GitHub (buildkite/buildkite-mcp-server)Fork to open a PR

# or from a terminal, under your own account:
gh repo fork buildkite/buildkite-mcp-server --clone && cd buildkite-mcp-server
curl -s https://killerskills.ai/skills/docker/buildkite/r5/patch.diff | git apply --unidiff-zero
git checkout -b killerskills/r5 && git commit -am "buildkite: Fake instruction boundary tag"
gh pr create --fill --body-file <(curl -s https://killerskills.ai/skills/docker/buildkite/r5/patch.md)

We count proposals opened, not merged: a merge shows up as a new version that the crawl re-runs. Disputes: the maintainer can contest the verdict from its page; a person reviews it and the outcome is published.