cron

Dangerous workflowscaution

One of five workflows uses pull_request_target, which warrants review because it can run with elevated repository context; however, no untrusted checkout or script-injection pattern was detected.

Lifecycle scriptscaution

A prepare script runs during installation, which adds execution surface for consumers, although this is not by itself evidence of poor maintenance or unsafe behavior.

Token permissionscaution

Most workflows use read-only permissions, but one workflow has top-level write access and the release workflow lacks top-level permissions, leaving some CI privilege configuration less constrained than ideal.