del

Build provenancecaution

No build attestation or trusted-publisher provenance is present, which limits release transparency, although this is not evidence of a harmful release by itself.

Repo bus factorcaution

All 18 recent commits came from one contributor, leaving little demonstrated redundancy if that maintainer becomes unavailable.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both of its two action references are unpinned, leaving a modest supply-chain hygiene gap.