Propose a patch

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

diff --git a/portal_mcp_server/cli.py b/portal_mcp_server/cli.py
--- a/portal_mcp_server/cli.py
+++ b/portal_mcp_server/cli.py
@@ -156,1 +156,0 @@
-f"user to paste the secret value into this conversation."
@@ -384,1 +383,0 @@
-f"{host}` in a separate terminal, type the password at the hidden "
@@ -407,1 +405,0 @@
-"in a separate terminal, type the password at the hidden prompt, then "
@@ -441,1 +438,0 @@
-"terminal first — never have them paste the password into the chat."
@@ -488,1 +484,0 @@
-22), key_path (else asyncssh falls back to ~/.ssh/id_* or ssh-agent),
@@ -496,1 +491,0 @@
-Hosts already defined in ~/.ssh/config are auto-resolved on first use; explicit
@@ -1217,1 +1211,0 @@
-`portal secret set <name>` in their own terminal; you pass
@@ -1429,1 +1422,0 @@
-you pass secrets=["<name>"] and reference it as the uppercased env var
diff --git a/README.en.md b/README.en.md
--- a/README.en.md
+++ b/README.en.md
@@ -314,1 +314,0 @@
-<summary>Expand</summary> [asyncssh](https://github.com/ronf/asyncssh) (EPL-2.0 / GPL-2.0 dual-licensed) is an independent pure-Python SSHv2 implementation, pro
@@ -326,1 +325,0 @@
-<summary>Expand</summary> Every credential kind — SSH key, login password, key passphrase, sudo password, named secret — is resolved on one in-process asyncssh 
@@ -343,1 +341,0 @@
-<summary>Expand</summary> A stdio MCP server's stderr is invisible to the user, so operationally important warnings (misconfigured yaml, missing credentials, ig
@@ -352,1 +349,0 @@
-<summary>Maintainer boundaries & footguns</summary> - **exec-output-strip vs. file-read-must-not-strip**: one-shot exec strips trailing newlines (shell conventi
@@ -417,1 +413,0 @@
-<summary>Expand the dev setup</summary> ```bash git clone [email protected]:TMYTiMidlY/portal-mcp-server.git cd portal-mcp-server uv sync --all-extras source .venv
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -219,1 +219,0 @@
-<summary>为什么这是一条不为便利让步的边界（"活过 agent 关闭"为何不靠子进程）</summary> agent 常想要"持久传输 / 活过 agent 关闭"，最直觉的实现是 `nohup` 一个 `scp` / `rsync` 子进程。portal **故意不做**——子进程那条路绕开了上面这条统一凭
diff --git a/portal_mcp_server/remote_bash.py b/portal_mcp_server/remote_bash.py
--- a/portal_mcp_server/remote_bash.py
+++ b/portal_mcp_server/remote_bash.py
@@ -64,1 +64,0 @@
-"terminal first (never have them paste the password into the conversation)."
diff --git a/tests/live_smoke.py b/tests/live_smoke.py
--- a/tests/live_smoke.py
+++ b/tests/live_smoke.py
@@ -36,1 +36,0 @@
-TEST_KEY = os.environ.get("PORTAL_TEST_KEY_PATH", os.path.expanduser("~/.ssh/id_ed25519"))
diff --git a/tests/test_live_ssh.py b/tests/test_live_ssh.py
--- a/tests/test_live_ssh.py
+++ b/tests/test_live_ssh.py
@@ -30,1 +30,0 @@
-TEST_KEY       = os.environ.get("PORTAL_TEST_KEY_PATH", os.path.expanduser("~/.ssh/id_ed25519"))
diff --git a/tests/test_host_normalize.py b/tests/test_host_normalize.py
--- a/tests/test_host_normalize.py
+++ b/tests/test_host_normalize.py
@@ -59,1 +59,0 @@
-monkeypatch.setenv("PORTAL_SSH_CONFIG", "none")  # don't read real ~/.ssh/config

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 4.0.3. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: portal-mcp-server: Prompting user to enter sensitive credentials (KillerSkills verdict caution 62)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **CAUTION 62/100**. Summary: no network, touches nothing outside the project, writes no memory.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/pypi/portal-mcp-server/4.0.3

## Findings with a location
- `portal_mcp_server/cli.py:407` · Prompting user to enter sensitive credentials — portal_mcp_server/cli.py:407 · Prompting user to enter sensitive credentials — social engineering
- `README.en.md:343` · Collapsed <details> block carrying instructions — README.en.md:343 · Collapsed <details> block carrying instructions
- `portal_mcp_server/cli.py:496` · Reads credential paths from the home directory — portal_mcp_server/cli.py:496 · Reads credential paths from the home directory
- `README.md:219` · Collapsed <details> block carrying instructions — README.md:219 · Collapsed <details> block carrying instructions
- `README.en.md:326` · Collapsed <details> block carrying instructions — README.en.md:326 · Collapsed <details> block carrying instructions
- `README.en.md:352` · Collapsed <details> block carrying instructions — README.en.md:352 · Collapsed <details> block carrying instructions
- `portal_mcp_server/cli.py:488` · References a credential file in the home directory — portal_mcp_server/cli.py:488 · References a credential file in the home directory
- `portal_mcp_server/cli.py:384` · Prompting user to enter sensitive credentials — portal_mcp_server/cli.py:384 · Prompting user to enter sensitive credentials — social engineering
- `portal_mcp_server/cli.py:156` · Prompting user to enter sensitive credentials — portal_mcp_server/cli.py:156 · Prompting user to enter sensitive credentials — social engineering
- `README.en.md:314` · Collapsed <details> block carrying instructions — README.en.md:314 · Collapsed <details> block carrying instructions
- `portal_mcp_server/cli.py:1217` · Credential pass-through configuration — portal_mcp_server/cli.py:1217 · Credential pass-through configuration — agent relays sensitive credentials
- `portal_mcp_server/cli.py:441` · Prompting user to enter sensitive credentials — portal_mcp_server/cli.py:441 · Prompting user to enter sensitive credentials — social engineering

## Proposed change
The attached patch removes the 18 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._