@kilocode/sdk

Workflow auditdanger

The audit is incomplete because only 30 of 38 workflows were analyzed; 98 of 109 action uses are unpinned, and high-confidence github-app, secrets-inherit, and template-injection findings widen automation exposure. The template-injection findings occur in generate.yml, which also has a script-injection finding, making this a meaningful supply-chain concern.

Maintainerscaution

Six of nine publishing accounts use the organization domain, supporting organizational control; johndotawesome and rso use Gmail, and jlambert_anaconda uses anaconda.com, creating account-hygiene caution but not evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match @kilocode/sdk and its README does not mention the package, so the package-to-repository relationship is less transparent even though the repository appears active.