Propose a patch

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -167,1 +167,0 @@
-<summary><b>Add the server to one agent by hand</b></summary> <br> No keys go in these commands; the server reads them from its config file. | Agent | Command |
@@ -274,1 +273,0 @@
-<summary><b>My agent says "Connection closed".</b></summary> <br> Run <code>uvx mpesa-daraja-mcp status</code>. It lists missing settings and re-tests your keys
diff --git a/skills/daraja-auth/SKILL.md b/skills/daraja-auth/SKILL.md
--- a/skills/daraja-auth/SKILL.md
+++ b/skills/daraja-auth/SKILL.md
@@ -66,1 +66,0 @@
-Node.js uses the same idea: `Buffer.from(`${key}:${secret}`).toString("base64")`, then `fetch(url, { headers: { Authorization: `Basic ${auth}` } })`.

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of r1. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: mpesa-daraja-mcp: Collapsed <details> block carrying instructions (KillerSkills verdict caution 62)

## What the honeypot observed
KillerSkills ran **mpesa-daraja-mcp@r1** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **CAUTION 62/100**. Summary: no network, touches nothing outside the project, writes no memory.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/glama/mpesa-daraja-mcp/r1

## Findings with a location
- `README.md:274` · Collapsed <details> block carrying instructions — README.md:274 · Collapsed <details> block carrying instructions
- `README.md:167` · Collapsed <details> block carrying instructions — README.md:167 · Collapsed <details> block carrying instructions
- `skills/daraja-auth/SKILL.md:66` · Host or code assembled from base64 fragments — skills/daraja-auth/SKILL.md:66 · Host or code assembled from base64 fragments

## Proposed change
The attached patch removes the 3 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._