@octokit/endpoint

Workflow auditdanger

All six workflows were analyzed and none combines an untrusted checkout or script injection with pull_request_target, but all 15 action references are unpinned and the audit found a high-confidence github-app issue where an app token inherits blanket installation permissions. Two workflows also grant top-level write access.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months, a meaningful maintenance concern despite the recent release and push timestamp.