comma-separated-tokens

Project backingcaution

The repository is maintained under a user account rather than an organization, so the single registry maintainer is not offset by organizational backing.

Release historycaution

The package has 13 releases over more than 10 years, but no releases in nearly four years; this indicates a mature yet inactive release history.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, consistent with the long release gap and raising abandonment risk.

Security policycaution

The repository has no security policy, a transparency gap for reporting vulnerabilities, though the small and stable package reduces the practical impact somewhat.

Workflow auditcaution

The only workflow was fully audited with no findings or untrusted triggers, but all three action references are unpinned, leaving avoidable workflow reproducibility risk.