Propose a patch

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

diff --git a/video/posts.py b/video/posts.py
--- a/video/posts.py
+++ b/video/posts.py
@@ -92,1 +92,0 @@
-html = f'''<!doctype html><html><head><meta charset="utf-8"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&family=JetBrains+Mono:wght@500&display=block" rel="style
diff --git a/web/index.html b/web/index.html
--- a/web/index.html
+++ b/web/index.html
@@ -194,1 +194,0 @@
-<summary>Can the agent raise its own budget?</summary><p>No. None of the seven tools writes the allowance. The owner controls answer only on this machine, never
@@ -196,1 +195,0 @@
-<summary>Who holds the key?</summary><p>You do. It's a file in <code>~/.allow</code> on your machine. Allow runs no custody server and never sees it.</p>
diff --git a/lib/jupiter.mjs b/lib/jupiter.mjs
--- a/lib/jupiter.mjs
+++ b/lib/jupiter.mjs
@@ -25,1 +25,0 @@
-const clean = (s, max) => String(s ?? "?").replace(/[\u0000-\u001f\u007f-\u009f​-‏‪-‮⁦-⁩<>`]/g, "").replace(/\s+/g, " ").trim().slice(0, max) || "?";
diff --git a/web/style.css b/web/style.css
--- a/web/style.css
+++ b/web/style.css
@@ -1,1 +1,0 @@
-@import url("https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;500&display=swap");

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 0.1.0. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: allow: URL with embedded credentials (KillerSkills verdict caution 67)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.7) and scored it **CAUTION 67/100**. Summary: no network, touches nothing outside the project, writes no memory.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/glama/allow/0.1.0

## Findings with a location
- `video/posts.py:92` · URL with embedded credentials — video/posts.py:92 · URL with embedded credentials — may be phishing or credential leaking
- `web/index.html:196` · Collapsed <details> block carrying instructions — web/index.html:196 · Collapsed <details> block carrying instructions · informational: not an instruction file
- `web/index.html:194` · Collapsed <details> block carrying instructions — web/index.html:194 · Collapsed <details> block carrying instructions · informational: not an instruction file
- `lib/jupiter.mjs:25` · Hidden zero-width characters detected — lib/jupiter.mjs:25 · Hidden zero-width characters detected — may conceal content
- `web/style.css:1` · URL with embedded credentials — web/style.css:1 · URL with embedded credentials — may be phishing or credential leaking

## Proposed change
The attached patch removes the 5 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._