Nm Pensive Makefile Review

Audit Makefiles for build correctness, portability, and recipe duplication

This skill appears to be a genuine Makefile auditing guide, but take these precautions before running it: (1) Confirm the platform config hooks (night-market.pensive:shared and night-market.imbue:proof-of-work) and what data they receive; (2) Ensure required tools (ripgrep/rg, make, python, pytest, etc.) exist and are the versions you expect — the skill does not declare them; (3) Treat any 'apply' or demo steps as potentially modifying or executing repository code: run in a safe environment or only run dry‑run/test modes (e.g., avoid --apply, use make -n, run generated targets inside an isolated container); (4) Inspect any helper scripts (makefile_dogfooder.py or similar) before allowing them to run; (5) If you need higher assurance, ask the maintainer to add an explicit list of required binaries, an explicit dry-run-first policy, and clearer documentation of what the imbue:proof-of-work hook transmits.

Type: OpenClaw Skill Name: nm-pensive-makefile-review Version: 1.0.0 The skill bundle contains instructions in SKILL.md and modules/plugin-dogfood-checks.md that direct the AI agent to execute an external script, 'makefile_dogfooder.py', which is not provided within the bundle. This script is invoked with flags like '--apply', indicating automated filesystem modification. Furthermore, the 'Demo Target Philosophy' section explicitly encourages the agent to create and run targets that execute 'ACTUAL functionality' rather than static checks, which introduces a high risk of arbitrary code execution during what is ostensibly a 'review' workflow.