Propose a patch

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

diff --git a/dist/oauth.d.ts b/dist/oauth.d.ts
--- a/dist/oauth.d.ts
+++ b/dist/oauth.d.ts
@@ -40,1 +40,0 @@
-* `https://user:pass@…` (embedded credentials) and have the OAuth server
diff --git a/dist/oauth.js b/dist/oauth.js
--- a/dist/oauth.js
+++ b/dist/oauth.js
@@ -94,1 +94,0 @@
-* `https://user:pass@…` (embedded credentials) and have the OAuth server
@@ -978,1 +977,0 @@
-// Reject userinfo (e.g. https://user:pass@evil/), non-default ports, and
diff --git a/dist/server.js b/dist/server.js
--- a/dist/server.js
+++ b/dist/server.js
@@ -1750,1 +1750,0 @@
-// above any realistic relay token.
diff --git a/dist/prompts.js b/dist/prompts.js
--- a/dist/prompts.js
+++ b/dist/prompts.js
@@ -91,1 +91,0 @@
-description: "Generate bridge workflow rules and quick-reference table, then write them into CLAUDE.md.",
@@ -440,1 +439,0 @@
-"## Phase 2 — Generate or update CLAUDE.md",
@@ -442,1 +440,0 @@
-"Based on the project info from Phase 1, create or update the project's CLAUDE.md.",
@@ -451,1 +448,0 @@
-…ilities` at the start of each session..."', "- Bug fix methodology (test-first: write failing test, fix, confirm)", "- Documentation & memory rules (update CLAUDE.md after arch changes, save decisions to memory, prune stale instructions)", "- Mo…
@@ -664,1 +660,0 @@
-Re-run project orientation: discover project type, update CLAUDE.md, and verify bridge connectivity.
diff --git a/dist/index.js b/dist/index.js
--- a/dist/index.js
+++ b/dist/index.js
@@ -471,1 +471,0 @@
---write               Write to CLAUDE.md in the workspace (default: print to stdout)
@@ -492,1 +491,0 @@
-process.stderr.write("Note: run with --write to append this section to CLAUDE.md and also write .claude/rules/bridge-tools.md\n");
@@ -501,1 +499,0 @@
-process.stderr.write(`CLAUDE.md bridge block already up to date (v${PACKAGE_VERSION}) — no changes made.\n`);
@@ -508,1 +505,0 @@
-process.stderr.write(`Updated CLAUDE.md bridge block to v${PACKAGE_VERSION}.\n`);
@@ -515,1 +511,0 @@
-process.stderr.write(`Patched existing CLAUDE.md — added missing @import line (v${PACKAGE_VERSION}).\n`);
diff --git a/dist/config.js b/dist/config.js
--- a/dist/config.js
+++ b/dist/config.js
@@ -864,1 +864,0 @@
-init                        One-command setup: install extension + write CLAUDE.md + register

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 1.2.7. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: patchwork-os: URL with embedded credentials (KillerSkills verdict caution 70)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **CAUTION 70/100**. Summary: no network, touches nothing outside the project, writes no memory.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/npm/patchwork-os/1.2.7

## Findings with a location
- `dist/oauth.d.ts:40` · URL with embedded credentials — dist/oauth.d.ts:40 · URL with embedded credentials — may be phishing or credential leaking
- `dist/oauth.js:94` · URL with embedded credentials — dist/oauth.js:94 · URL with embedded credentials — may be phishing or credential leaking
- `dist/oauth.js:978` · URL with embedded credentials — dist/oauth.js:978 · URL with embedded credentials — may be phishing or credential leaking
- `dist/server.js:1750` · Credential pass-through configuration — dist/server.js:1750 · Credential pass-through configuration — agent relays sensitive credentials
- `dist/prompts.js:91` · Instructs the agent to modify its persistent memory or instruction files — dist/prompts.js:91 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `dist/index.js:501` · Instructs the agent to modify its persistent memory or instruction files — dist/index.js:501 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `dist/index.js:471` · Instructs the agent to modify its persistent memory or instruction files — dist/index.js:471 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `dist/index.js:508` · Instructs the agent to modify its persistent memory or instruction files — dist/index.js:508 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `dist/prompts.js:442` · Instructs the agent to modify its persistent memory or instruction files — dist/prompts.js:442 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `dist/prompts.js:451` · Instructs the agent to modify its persistent memory or instruction files — dist/prompts.js:451 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `dist/config.js:864` · Instructs the agent to modify its persistent memory or instruction files — dist/config.js:864 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `dist/index.js:492` · Instructs the agent to modify its persistent memory or instruction files — dist/index.js:492 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file

## Proposed change
The attached patch removes the 15 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._