@datadog/datadog-ci-plugin-sbom

Repo package mentioncaution

The linked monorepo neither matches the package name nor mentions it in the README, creating some uncertainty about package-to-repository mapping. Its Datadog organization ownership and broader repository context partly compensate.

Security policycaution

The repository has no published security policy. This is a transparency gap, although the active organization-backed project and Dependabot scanning partly reduce the concern.

Workflow auditcaution

All four workflows were analyzed, but one file failed audit. The audit found high-confidence template-injection patterns and one workflow with top-level write permissions; no untrusted checkout or script-injection path was reported, so this is a workflow-hygiene caution rather than a severe risk.