@argos-ci/core

Dependency profilecaution

Nine runtime dependencies create a meaningful dependency surface, including native or operationally significant packages such as sharp, but the profile is not excessive for an SDK.

Maintainerscaution

Only one registry account has publish access, which is a modest publishing concentration risk; organization backing and strong repository activity provide meaningful operational support.

Repo toolingcaution

The repository uses TypeScript, Turbo, and npm scripts, but reports no security scanning tools; the missing scanning is a transparency and assurance gap, not evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Token permissionscaution

Two workflows lack top-level permissions and one release workflow requests top-level write access; this is a workflow-hardening gap, though no dangerous workflow behavior was detected.