Propose a patch

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -130,1 +130,0 @@
-<summary><b>Gemini CLI, Windsurf, anything else</b></summary> It is a standard stdio MCP server: add `{ "command": "uvx", "args": ["mobile-ir-mcp"] }` to the cl
diff --git a/tests/fixtures/comments.html b/tests/fixtures/comments.html
--- a/tests/fixtures/comments.html
+++ b/tests/fixtures/comments.html
@@ -14,1 +14,0 @@
-<option value="DateAsc">قدیمی‌ترین</option>
@@ -15,1 +14,0 @@
-<option value="PositiveVotes">رای‌های مثبت</option>
@@ -16,1 +14,0 @@
-<option value="NegativeVotes">رای‌های منفی</option>
@@ -18,1 +15,0 @@
-<option value="VotesAsc">پایین‌ترین رای</option>
diff --git a/tests/fixtures/news_list.html b/tests/fixtures/news_list.html
--- a/tests/fixtures/news_list.html
+++ b/tests/fixtures/news_list.html
@@ -4,1 +4,0 @@
-<a href="/news/view-6552-samsung-q3-2026-financial-results.aspx">گزارش مالی سامسونگ از سه‌ماهه سوم سال 2026 - رونق نیمه‌رساناها و چالش سایر کسب‌وکارها</a>
@@ -11,1 +10,0 @@
-…ir/Static/cache/newsthumbs/6552_2.jpg"/> </a> شرکت سامسونگ در روز پنج‌شنبه 29 اکتبر 2026 (7 آبان 1405) گزارش مالی خود را از سه‌ماهه سوم سال جاری میلاد…
diff --git a/tests/fixtures/related.html b/tests/fixtures/related.html
--- a/tests/fixtures/related.html
+++ b/tests/fixtures/related.html
@@ -7,1 +7,0 @@
-<a href="/news/view-6466-counterpoint-global-best-selling-smartphone-and-smartphone-os-in-q2-2026.aspx">آیفون 17 پر فروش‌ترین گوشی بازار و S26 Ultra پر فروش‌ترین اندروید در سه‌ماهه دوم 2026</a>
@@ -13,1 +12,0 @@
-<a href="/phones/intro-41113-samsung-galaxy-s26-ultra.aspx">معرفی سامسونگ Galaxy S26 Ultra کپی برابر اصل S25 Ultra با لنزهای سریع‌تر و شارژ 60 واتی </a>
diff --git a/tests/fixtures/prices.html b/tests/fixtures/prices.html
--- a/tests/fixtures/prices.html
+++ b/tests/fixtures/prices.html
@@ -258,1 +258,0 @@
-<th nowrap="">مقایسه با قیمت<br/>سایر فروشگاه‌ها</th>
@@ -293,1 +292,0 @@
-کمترین قیمت در فروشگاه‌ها: <br/>
@@ -297,1 +295,0 @@
-<img src="/Static/css/images/price_max01.gif"/> بیشترین قیمت در فروشگاه‌ها: <br/>
@@ -348,1 +345,0 @@
-کمترین قیمت در فروشگاه‌ها: <br/>
@@ -352,1 +348,0 @@
-<img src="/Static/css/images/price_max01.gif"/> بیشترین قیمت در فروشگاه‌ها: <br/>
diff --git a/tests/fixtures/article.html b/tests/fixtures/article.html
--- a/tests/fixtures/article.html
+++ b/tests/fixtures/article.html
@@ -1,1 +1,0 @@
-<html><head><title>اخبار و خواندنی های موبایل | گزارش مالی سامسونگ از سه‌ماهه سوم سال 2026 - رونق نیمه‌رساناها و چالش سایر کسب‌وکارها | mobile.ir</title>…
diff --git a/tests/fixtures/reviews_list.html b/tests/fixtures/reviews_list.html
--- a/tests/fixtures/reviews_list.html
+++ b/tests/fixtures/reviews_list.html
@@ -11,1 +11,0 @@
-…یوو همچون سری فایند اوپو محلی برای مشاهده آخرین دستاوردهای تکنیکی این دو شرکت هم‌خانواده به‌خصوص در حوزه مولتی‌مدیا و تصویر است و با حضور نمونه‌های محبوبی همچون …
diff --git a/tests/fixtures/spec.html b/tests/fixtures/spec.html
--- a/tests/fixtures/spec.html
+++ b/tests/fixtures/spec.html
@@ -56,1 +56,0 @@
-<a class="bookmark favorite-button" href="/users/account/bookmark.aspx?type=PhoneRecord&amp;id=41113" title="اضافه کردن به علاقه‌مندی‌ها">
@@ -410,1 +409,0 @@
-8K@24/30fps, 4K@30/60/120fps, 1080p@30/60/120/240fps, 10-bit HDR, دارای فناوری HDR10 پلاس+, ضبط صدا بصورت استریو, تثبیت‌ کننده تصویر ژیروسکوپی
diff --git a/tests/fixtures/shops.html b/tests/fixtures/shops.html
--- a/tests/fixtures/shops.html
+++ b/tests/fixtures/shops.html
@@ -56,1 +56,0 @@
-<a class="bookmark favorite-button" href="/users/account/bookmark.aspx?type=PhoneRecord&amp;id=41045" title="اضافه کردن به علاقه‌مندی‌ها">
@@ -70,1 +69,0 @@
-تنها ارائه کننده اطلاعات وارد شده توسط فروشندگان می‌باشد و
@@ -77,1 +75,0 @@
-حتما پیش از خرید، استعلام اصالت کنید. حتما از فروشنده کد فعال‌سازی را دریافت نموده و دستگاه را از طریق #7777*، برای سیم‌کارت خود فعال‌سازی نمایید.

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 0.2.0. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: mobile-ir-mcp: Collapsed <details> block carrying instructions (KillerSkills verdict caution 60)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **CAUTION 60/100**. Summary: static analysis only — behavior not yet observed.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/pypi/mobile-ir-mcp/0.2.0

## Findings with a location
- `README.md:130` · Collapsed <details> block carrying instructions — README.md:130 · Collapsed <details> block carrying instructions
- `tests/fixtures/comments.html:18` · Hidden zero-width characters detected — tests/fixtures/comments.html:18 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/comments.html:15` · Hidden zero-width characters detected — tests/fixtures/comments.html:15 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/news_list.html:4` · Hidden zero-width characters detected — tests/fixtures/news_list.html:4 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/related.html:13` · Hidden zero-width characters detected — tests/fixtures/related.html:13 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/prices.html:293` · Hidden zero-width characters detected — tests/fixtures/prices.html:293 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/article.html:1` · Hidden zero-width characters detected — tests/fixtures/article.html:1 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/prices.html:348` · Hidden zero-width characters detected — tests/fixtures/prices.html:348 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/comments.html:14` · Hidden zero-width characters detected — tests/fixtures/comments.html:14 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/reviews_list.html:11` · Hidden zero-width characters detected — tests/fixtures/reviews_list.html:11 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/prices.html:297` · Hidden zero-width characters detected — tests/fixtures/prices.html:297 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/prices.html:352` · Hidden zero-width characters detected — tests/fixtures/prices.html:352 · Hidden zero-width characters detected — may conceal content

## Proposed change
The attached patch removes the 21 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._