Propose a patch

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

diff --git a/pyproject.toml b/pyproject.toml
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -353,1 +353,0 @@
-# The copier-update migration reads the pre-update CLAUDE.md with a fixed-argv
diff --git a/scripts/migrate_agent_instructions.py b/scripts/migrate_agent_instructions.py
--- a/scripts/migrate_agent_instructions.py
+++ b/scripts/migrate_agent_instructions.py
@@ -1,1 +1,0 @@
-"""Move a downstream from CLAUDE.md to AGENTS.md during `copier update`.
@@ -6,1 +5,0 @@
-content used to be; the project's real pre-update CLAUDE.md is still at git
@@ -142,1 +140,0 @@
-actions.append("rewrote CLAUDE.md as the @AGENTS.md stub")
@@ -145,1 +142,0 @@
-"CLAUDE.md content before this update is at `git show HEAD:CLAUDE.md`; "

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 6.1.0. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: markdown-vault-mcp: Instructs the agent to modify its persistent memory or instruction files (KillerSkills verdict caution 73)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.7) and scored it **CAUTION 73/100**. Summary: no network, touches nothing outside the project, writes no memory.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/pypi/markdown-vault-mcp/6.1.0

## Findings with a location
- `pyproject.toml:353` · Instructs the agent to modify its persistent memory or instruction files — pyproject.toml:353 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `scripts/migrate_agent_instructions.py:6` · Instructs the agent to modify its persistent memory or instruction files — scripts/migrate_agent_instructions.py:6 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `scripts/migrate_agent_instructions.py:145` · Instructs the agent to modify its persistent memory or instruction files — scripts/migrate_agent_instructions.py:145 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `scripts/migrate_agent_instructions.py:1` · Instructs the agent to modify its persistent memory or instruction files — scripts/migrate_agent_instructions.py:1 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
- `scripts/migrate_agent_instructions.py:142` · Instructs the agent to modify its persistent memory or instruction files — scripts/migrate_agent_instructions.py:142 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file

## Proposed change
The attached patch removes the 5 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._