nexus-proposal-scout

Purpose and capabilities are mostly aligned: it reads org policy, checks backlog, drafts one proposal, submits it, and posts a short notice. The main risk is trust in the unverifiable `probe` CLI plus autonomous write actions through that backend; GitHub usage appears normal and same-purpose. Overall this is suspicious/high-risk from a supply-chain and agent-action perspective, but not confirmed malware.