Propose a patch

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

diff --git a/tests/fixtures/product_list.html b/tests/fixtures/product_list.html
--- a/tests/fixtures/product_list.html
+++ b/tests/fixtures/product_list.html
@@ -220,1 +220,0 @@
-از آن جایی که هندزفری‌ های سیمی می‌توانند گاهی دست و پا گیر باشند یا امکان استفاده از آن‌ها در هر شرایطی امکان پذیر نباشد. کاربران به استفاده از هندزفری‌ های بلوتوث ترغیب شده‌اند که کاملا بدون سیم هست
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -168,1 +168,0 @@
-<summary><b>Anything else</b></summary> It's a standard stdio MCP server: run `uvx masterkala-mcp`, or `pip install masterkala-mcp` and run `masterkala-mcp`.
diff --git a/tests/fixtures/attributes.json b/tests/fixtures/attributes.json
--- a/tests/fixtures/attributes.json
+++ b/tests/fixtures/attributes.json
@@ -33,1 +33,0 @@
-"27144": "31*61*96 میلی‌متر"
@@ -52,1 +51,0 @@
-"name": "نسخه‌ی بلوتوث",
diff --git a/tests/fixtures/category.html b/tests/fixtures/category.html
--- a/tests/fixtures/category.html
+++ b/tests/fixtures/category.html
@@ -2,1 +2,0 @@
-<script>filter_obj = JSON.parse('[{"filter_group_id":"50","name":"برند","filter":[{"filter_id":"m288","name":"1More"},{"filter_id":"m287","name":"70Mai"},{"filter_id":"m309","name":"Amazfit"}]},{"filt
diff --git a/tests/fixtures/blog_posts.json b/tests/fixtures/blog_posts.json
--- a/tests/fixtures/blog_posts.json
+++ b/tests/fixtures/blog_posts.json
@@ -19,1 +19,0 @@
-"title": "بهترین هندزفری‌های بلوتوثی برای مکالمه بدون نویز (معرفی برترین مدل‌ها)",
diff --git a/tests/fixtures/product_24855.html b/tests/fixtures/product_24855.html
--- a/tests/fixtures/product_24855.html
+++ b/tests/fixtures/product_24855.html
@@ -62,1 +62,0 @@
-,{"@context":"https:\/\/schema.org","type":"VideoObject","name":"هندزفری بلوتوث سی ام اف CMF Buds Pro 2","description":"هندزفری بلوتوث CMF Buds Pro 2 با طراحی بی‌سیم و کیفیت صدای مناسب؛ گزینه‌ای کاربر
diff --git a/tests/fixtures/reviews.json b/tests/fixtures/reviews.json
--- a/tests/fixtures/reviews.json
+++ b/tests/fixtures/reviews.json
@@ -43,1 +43,0 @@
-"reply": "سلام، هر دو هندزفری دارای کیفیت صدای بالا و قابل قبولی هستند. نسبت به قیمت بالا‌تری که هندزفری X1 2023 دارد. کیفیت پخش موسیقی آن نیز کمی بهتر می‌باشد.",

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 0.4.2. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: masterkala-mcp: Hidden zero-width characters detected (KillerSkills verdict caution 74)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.7) and scored it **CAUTION 74/100**. Summary: no network, touches nothing outside the project, writes no memory.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/pypi/masterkala-mcp/0.4.2

## Findings with a location
- `tests/fixtures/product_list.html:220` · Hidden zero-width characters detected — tests/fixtures/product_list.html:220 · Hidden zero-width characters detected — may conceal content
- `README.md:168` · Collapsed <details> block carrying instructions — README.md:168 · Collapsed <details> block carrying instructions
- `tests/fixtures/attributes.json:52` · Hidden zero-width characters detected — tests/fixtures/attributes.json:52 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/category.html:2` · Hidden zero-width characters detected — tests/fixtures/category.html:2 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/attributes.json:33` · Hidden zero-width characters detected — tests/fixtures/attributes.json:33 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/blog_posts.json:19` · Hidden zero-width characters detected — tests/fixtures/blog_posts.json:19 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/product_24855.html:62` · Hidden zero-width characters detected — tests/fixtures/product_24855.html:62 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/reviews.json:43` · Hidden zero-width characters detected — tests/fixtures/reviews.json:43 · Hidden zero-width characters detected — may conceal content

## Proposed change
The attached patch removes the 8 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._