Propose a patch

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -71,1 +71,0 @@
-<summary><strong>Requirements and what happens without them</strong></summary> - **Node.js 22.18.0+ on Node 22, or 24.11.0+**, for the hooks and the MCP server.
@@ -230,1 +229,0 @@
-<summary><strong>The knowledge graph</strong></summary> ``` you touch src/auth.ts │ ├─ verify() compares exp against the LOCAL clock (finding, 0.9) ├─ per-host 
@@ -307,1 +305,0 @@
-<summary><strong>Privacy and telemetry</strong></summary> - Nothing is measured about you unless you ask. Anonymous usage data takes two separate opt-ins: `TOKE
@@ -326,1 +323,0 @@
-<summary><strong>Verify the release, or remove it</strong></summary> Releases are published from CI with npm provenance, so `npm audit signatures` ties the pack
diff --git a/dist/proxy/server.js b/dist/proxy/server.js
--- a/dist/proxy/server.js
+++ b/dist/proxy/server.js
@@ -1603,1 +1603,0 @@
-throw new Error(`token-optimizer proxy: refusing to forward credentials to ${upstream} -- ` +

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 7.11.0. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: token-optimizer-mcp: Collapsed <details> block carrying instructions (KillerSkills verdict caution 70)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **CAUTION 70/100**. Summary: no network, touches nothing outside the project, writes no memory.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/npm/token-optimizer-mcp/7.11.0

## Findings with a location
- `README.md:71` · Collapsed <details> block carrying instructions — README.md:71 · Collapsed <details> block carrying instructions
- `README.md:230` · Collapsed <details> block carrying instructions — README.md:230 · Collapsed <details> block carrying instructions
- `dist/proxy/server.js:1603` · Credential pass-through configuration — dist/proxy/server.js:1603 · Credential pass-through configuration — agent relays sensitive credentials
- `README.md:326` · Collapsed <details> block carrying instructions — README.md:326 · Collapsed <details> block carrying instructions
- `README.md:307` · Collapsed <details> block carrying instructions — README.md:307 · Collapsed <details> block carrying instructions

## Proposed change
The attached patch removes the 5 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._