Nm Minister Release Health Gates

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:39 PM UTC
• Version:
  1.0.2

Overview

This skill is a release-readiness checklist with disclosed GitHub and tracker workflow guidance, and I found no hidden code or unsafe automation.

Use this as a release-governance helper. Before allowing it to draft or update PR comments, tracker records, waiver notes, or retrospective artifacts, confirm the target repo, PR, release scope, and tracker project, and review generated content before it is posted or saved.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest defines triggers as generic terms like "release," "github," "readiness," "quality," and "governance" without any scoping, constraints, or negative examples. Several of these words are common in ordinary software discussions, making activation boundaries unclear and increasing the risk of accidental skill invocation.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 70% confidence
• Finding: Shadow Command Trigger: 'release' conflicts with built-in command 'release'

VirusTotal

65/65 vendors flagged this skill as clean.