Propose a patch

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

diff --git a/tests/fixtures/law_sectionstatus.html b/tests/fixtures/law_sectionstatus.html
--- a/tests/fixtures/law_sectionstatus.html
+++ b/tests/fixtures/law_sectionstatus.html
@@ -13,1 +13,0 @@
-…دل‏ قرآن‏، در پي‏ انقلاب‏ اسلامي پيروزمند خود به رهبري‏ مرجع عاليقدر تقليد آيت ‏‌الله‏‌ العظمي‏ امام‏ خميني‏، در همه‏ پرسي‏ دهم‏ و يازدهم‏ فروردين ماه‏ يكهزار و …
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -137,1 +137,0 @@
-<summary><b>Anything else</b></summary> It's a standard stdio MCP server: run `uvx qavanin-mcp`, or `pip install qavanin-mcp` and run `qavanin-mcp`.
diff --git a/tests/fixtures/search_results.html b/tests/fixtures/search_results.html
--- a/tests/fixtures/search_results.html
+++ b/tests/fixtures/search_results.html
@@ -31,1 +31,0 @@
-…د مواد 87، 242 و 243 قانون <span class='white background-DarkBlue'>ماليات</span>‌هاي مستقيم</a> </td> …
@@ -45,1 +44,0 @@
-…راي تبصره ماده (100) قانون <span class='white background-DarkBlue'>ماليات</span>‌هاي مستقيم اصلاحي مصوب 1394/04/31‌ </a> </td…
@@ -59,1 +57,0 @@
-… background-DarkBlue'>ماليات</span>ي كشور در خصوص حذف عبارت به استثناء انواع شير‌هاي طعم دار از كليه مكاتبات و فهرست هاي مصاديق كالا‌ها و خدمات معاف موضوع قوانين…
diff --git a/src/qavanin_mcp/search.py b/src/qavanin_mcp/search.py
--- a/src/qavanin_mcp/search.py
+++ b/src/qavanin_mcp/search.py
@@ -50,1 +50,0 @@
-120: "بخشنامه‌های قوه قضائیه",
diff --git a/tests/fixtures/law_treetext_civil_excerpt.html b/tests/fixtures/law_treetext_civil_excerpt.html
--- a/tests/fixtures/law_treetext_civil_excerpt.html
+++ b/tests/fixtures/law_treetext_civil_excerpt.html
@@ -348,1 +348,0 @@
-… target=_blank>نظر معاونت حقوقي رياست جمهوري درخصوص امكان اجراي قانون جامع خدمات‌ رساني به ايثارگران تا پيش از تنظيم آيين‌ نامه‌ هاي مربوطه و تأمين اعتبار</a><a …
@@ -350,1 +349,0 @@
-…ت بماقبل خود اثر ندارد مگر اينكه در خود قانون، مقررات خاصي نسبت باين موضوع اتخاذ‌ شده باشد.</p> <!-- ...trimmed... --> 
diff --git a/tests/fixtures/law_statusindex.html b/tests/fixtures/law_statusindex.html
--- a/tests/fixtures/law_statusindex.html
+++ b/tests/fixtures/law_statusindex.html
@@ -611,1 +611,0 @@
-…دل‏ قرآن‏، در پي‏ انقلاب‏ اسلامي پيروزمند خود به رهبري‏ مرجع عاليقدر تقليد آيت ‏‌الله‏‌ العظمي‏ امام‏ خميني‏، در همه‏ پرسي‏ دهم‏ و يازدهم‏ فروردين ماه‏ يكهزار و …

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 0.2.1. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: qavanin-mcp: Hidden zero-width characters detected (KillerSkills verdict caution 77)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **CAUTION 77/100**. Summary: no network, touches nothing outside the project, writes no memory.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/pypi/qavanin-mcp/0.2.1

## Findings with a location
- `tests/fixtures/law_sectionstatus.html:13` · Hidden zero-width characters detected — tests/fixtures/law_sectionstatus.html:13 · Hidden zero-width characters detected — may conceal content
- `README.md:137` · Collapsed <details> block carrying instructions — README.md:137 · Collapsed <details> block carrying instructions
- `tests/fixtures/search_results.html:59` · Hidden zero-width characters detected — tests/fixtures/search_results.html:59 · Hidden zero-width characters detected — may conceal content
- `src/qavanin_mcp/search.py:50` · Hidden zero-width characters detected — src/qavanin_mcp/search.py:50 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/law_treetext_civil_excerpt.html:348` · Hidden zero-width characters detected — tests/fixtures/law_treetext_civil_excerpt.html:348 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/search_results.html:31` · Hidden zero-width characters detected — tests/fixtures/search_results.html:31 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/search_results.html:45` · Hidden zero-width characters detected — tests/fixtures/search_results.html:45 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/law_statusindex.html:611` · Hidden zero-width characters detected — tests/fixtures/law_statusindex.html:611 · Hidden zero-width characters detected — may conceal content
- `tests/fixtures/law_treetext_civil_excerpt.html:350` · Hidden zero-width characters detected — tests/fixtures/law_treetext_civil_excerpt.html:350 · Hidden zero-width characters detected — may conceal content

## Proposed change
The attached patch removes the 9 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._