Propose a patch

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

diff --git a/dist/context.js b/dist/context.js
--- a/dist/context.js
+++ b/dist/context.js
@@ -186,1 +186,0 @@
-/** MEMORY.md is append-only, so it gets its own (larger) budget. */
@@ -697,1 +696,0 @@
-// AGENTS.md is head-clipped; MEMORY.md is append-only so it uses the
diff --git a/dist/index.js b/dist/index.js
--- a/dist/index.js
+++ b/dist/index.js
@@ -4128,1 +4128,0 @@
-// `/remember <text>` — append a durable note to the project MEMORY.md.
@@ -4131,1 +4130,0 @@
-// write to the workdir's own MEMORY.md (the deepest file the loader reads)
@@ -4164,1 +4162,0 @@
-// Like Codex: let the agent explore the project and write AGENTS.md via
@@ -4170,1 +4167,0 @@
-'configs, CI, and a sample of source files). Then write AGENTS.md with: ' +
diff --git a/dist/i18n/help.js b/dist/i18n/help.js
--- a/dist/i18n/help.js
+++ b/dist/i18n/help.js
@@ -571,1 +571,0 @@
-en: '/remember <text>         append a note to the project MEMORY.md (creates it)',

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 2.96.20. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: zames_pro: Instructs the agent to modify its persistent memory or instruction files (KillerSkills verdict caution 69)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.7) and scored it **CAUTION 69/100**. Summary: no network, touches nothing outside the project, writes no memory.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/npm/zames_pro/2.96.20

## Findings with a location
- `dist/context.js:697` · Instructs the agent to modify its persistent memory or instruction files — dist/context.js:697 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `dist/index.js:4131` · Instructs the agent to modify its persistent memory or instruction files — dist/index.js:4131 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `dist/i18n/help.js:571` · Instructs the agent to modify its persistent memory or instruction files — dist/i18n/help.js:571 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `dist/context.js:186` · Instructs the agent to modify its persistent memory or instruction files — dist/context.js:186 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `dist/index.js:4128` · Instructs the agent to modify its persistent memory or instruction files — dist/index.js:4128 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `dist/index.js:4164` · Instructs the agent to modify its persistent memory or instruction files — dist/index.js:4164 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `dist/index.js:4170` · Instructs the agent to modify its persistent memory or instruction files — dist/index.js:4170 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file

## Proposed change
The attached patch removes the 7 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._