Nm Minister Github Initiative Pulse

AdvisoryAudited by Static analysis on May 9, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Generated summaries could be posted to the wrong GitHub location or reveal internal project status if not reviewed first.

Why it was flagged

The skill may guide a user or agent to publish project status content to GitHub. This is purpose-aligned, but GitHub comments, discussions, and issues can be team- or public-facing mutations.

Skill content
Provides markdown helpers and CSV exports for pasting into issues, PRs, or Discussions. ... Encourages posting digests to coordination issues or PR timelines.
Recommendation

Review the generated markdown/CSV content and confirm the repository, issue, PR, or discussion before posting or filing follow-up issues.

What this means

If users install or run the external tracker/plugin, its code and permissions would determine additional risk beyond this skill package.

Why it was flagged

The submitted package is instruction-only, while the documented full workflow depends on external helper/plugin components that were not included in the reviewed artifacts.

Skill content
Capture work via `tracker.py add` or sync from GitHub Projects. ... For the full experience with agents, hooks, and commands, install the Claude Code plugin.
Recommendation

Review the external tracker.py or Claude Code plugin source and permissions separately before installing or granting GitHub access.