Nm Minister Github Initiative Pulse

PassAudited by VirusTotal on May 9, 2026.

Overview

Type: OpenClaw Skill Name: nm-minister-github-initiative-pulse Version: 1.0.2 The skill bundle contains documentation and markdown templates for generating GitHub status reports and digests. It references an external script 'tracker.py' for data processing, but the provided files (SKILL.md, modules/github-comment-snippets.md, and modules/status-digest.md) consist only of legitimate instructions and formatting guides for project management tasks without any evidence of malicious intent or prompt injection.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Generated summaries could be posted to the wrong GitHub location or reveal internal project status if not reviewed first.

Why it was flagged

The skill may guide a user or agent to publish project status content to GitHub. This is purpose-aligned, but GitHub comments, discussions, and issues can be team- or public-facing mutations.

Skill content
Provides markdown helpers and CSV exports for pasting into issues, PRs, or Discussions. ... Encourages posting digests to coordination issues or PR timelines.
Recommendation

Review the generated markdown/CSV content and confirm the repository, issue, PR, or discussion before posting or filing follow-up issues.

What this means

If users install or run the external tracker/plugin, its code and permissions would determine additional risk beyond this skill package.

Why it was flagged

The submitted package is instruction-only, while the documented full workflow depends on external helper/plugin components that were not included in the reviewed artifacts.

Skill content
Capture work via `tracker.py add` or sync from GitHub Projects. ... For the full experience with agents, hooks, and commands, install the Claude Code plugin.
Recommendation

Review the external tracker.py or Claude Code plugin source and permissions separately before installing or granting GitHub access.