@cspell/cspell-resolver

Repo bus factorcaution

One contributor made about 87% of recent commits, which concentrates operational knowledge. However, the repository is organization-owned and eight other contributors were active, partly compensating for that concentration.

Repo package mentioncaution

The repository name differs from the package name and its README does not mention this package, creating some uncertainty about the package-to-repository linkage. The package is scoped under the same project family, so this is a caution rather than a severe concern.

Workflow auditcaution

The audit found a high-confidence github-app issue where an app token inherits blanket installation permissions, and only 30 of 37 workflows were analyzed. The pull_request_target triggers had no reported untrusted checkout or script-injection sinks, but the credential scope remains a real hygiene concern.