Nm Pensive Unified Review

Orchestrate multiple review types into a single multi-domain review with integrated reporting

This skill appears coherent for orchestrating multi-domain code reviews, but it will read your repository and may run tests or repository scripts. Before installing or invoking it: (1) run it in a sandbox or CI worker rather than on a sensitive local machine; (2) inspect any repo scripts it calls (e.g., scripts/deferred_capture.py) before allowing execution; (3) ensure your repo does not contain secrets that could be captured in evidence output; (4) if you want to limit blast radius, disable autonomous invocation or only invoke the skill manually; and (5) verify the night-market config keys it expects exist and are appropriate for your environment.

Type: OpenClaw Skill Name: nm-pensive-unified-review Version: 1.0.0 The skill bundle provides a framework for orchestrating multi-domain code reviews using structured workflows and templates. It is classified as suspicious because SKILL.md contains an explicit instruction for the agent to execute a local Python script (scripts/deferred_capture.py) automatically "without prompting the user" to log findings. While this behavior is aligned with the tool's stated purpose of automated orchestration, the instruction to bypass user confirmation for script execution is a risky pattern that could be exploited to run unauthorized commands if the script or the findings were manipulated.