makefile-validator

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill executes pip install mbake (scripts/validate_makefile.sh:141), which installs the mbake package from PyPI over the network at runtime without pinning or checksum verification, representing a weak/unknown/suspicious operational dependency.