Nm Minister Github Initiative Pulse

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:39 PM UTC
• Version:
  1.0.2

Overview

This is a markdown-only GitHub reporting helper with broad activation triggers but no executable code or hidden behavior in the reviewed artifact.

Installers should treat this as a lightweight reporting/template skill. Review generated GitHub digests before posting because they may contain project-sensitive status or risk details, and separately inspect any external tracker.py or full Night Market/minister plugin before granting it GitHub access.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list contains generic words such as "github," "projects," "reporting," and "status," which are common in many unrelated conversations and workflows. The file does not provide narrowing context, explicit invocation constraints, or negative examples to distinguish when this skill should activate versus when it should not.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 70% confidence
• Finding: Shadow Command Trigger: 'status' conflicts with built-in command 'status'

VirusTotal

65/65 vendors flagged this skill as clean.