Propose a patch

Evidence

• Read ~/.config/gh/hosts.yml in the decoy home directory.

diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -41,1 +41,0 @@
-Terminal recording: npx delimit-cli remember "Auth uses session cookies, not JWT. Decided after the token-leak review." prints "Remembered. (1 memory total)", t
diff --git a/lib/auth-setup.js b/lib/auth-setup.js
--- a/lib/auth-setup.js
+++ b/lib/auth-setup.js
@@ -655,1 +655,0 @@
-const credContent = `https://${github.username}:${github.token}@github.com\n`;
diff --git a/lib/managed-section.js b/lib/managed-section.js
--- a/lib/managed-section.js
+++ b/lib/managed-section.js
@@ -61,1 +61,0 @@
-const existing = rawExisting.replace(/^/, '');
diff --git a/bin/delimit-setup.js b/bin/delimit-setup.js
--- a/bin/delimit-setup.js
+++ b/bin/delimit-setup.js
@@ -612,1 +612,0 @@
-log(`    • Update CLAUDE.md with Delimit instructions`);
@@ -734,1 +733,0 @@
-// Step 5: Create/update CLAUDE.md and platform instruction files
diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1211,1 +1211,0 @@
-- Add social scanning instruction to CLAUDE.md template (99531620)
@@ -1239,1 +1238,0 @@
-- auto-update CLAUDE.md with marker-based upsert (LED-006) (7b46a68a)
@@ -1317,1 +1315,0 @@
-- update: README + CLAUDE.md + description to governance toolkit positioning (832a961a)
@@ -1433,1 +1430,0 @@
-- Update CLAUDE.md template branding and GitHub URL (9fac51be)
@@ -1436,1 +1432,0 @@
-- release: v3.11.4 — CLAUDE.md auto-update with versioned markers (66db96dd)

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 4.24.0. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: delimit-cli: Read ~/.config/gh/hosts.yml in the decoy home directory (KillerSkills verdict blocked 30)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **BLOCKED 30/100**. Summary: no network, touches nothing outside the project, writes no memory.

- Read ~/.config/gh/hosts.yml in the decoy home directory.

Full trace and findings: https://killerskills.ai/skills/npm/delimit-cli/4.24.0

## Findings with a location
- `README.md:41` · Image alt text carrying instructions — README.md:41 · Image alt text carrying instructions
- `lib/auth-setup.js:655` · URL with embedded credentials — lib/auth-setup.js:655 · URL with embedded credentials — may be phishing or credential leaking
- `lib/managed-section.js:61` · Hidden zero-width characters detected — lib/managed-section.js:61 · Hidden zero-width characters detected — may conceal content
- `bin/delimit-setup.js:612` · Instructs the agent to modify its persistent memory or instruction files — bin/delimit-setup.js:612 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `CHANGELOG.md:1211` · Instructs the agent to modify its persistent memory or instruction files — CHANGELOG.md:1211 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `CHANGELOG.md:1239` · Instructs the agent to modify its persistent memory or instruction files — CHANGELOG.md:1239 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `CHANGELOG.md:1436` · Instructs the agent to modify its persistent memory or instruction files — CHANGELOG.md:1436 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `CHANGELOG.md:1317` · Instructs the agent to modify its persistent memory or instruction files — CHANGELOG.md:1317 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `bin/delimit-setup.js:734` · Instructs the agent to modify its persistent memory or instruction files — bin/delimit-setup.js:734 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `CHANGELOG.md:1433` · Instructs the agent to modify its persistent memory or instruction files — CHANGELOG.md:1433 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file

## Proposed change
The attached patch removes the 10 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._