extend

Dangerous workflowscaution

Two of five workflows use pull_request_target, which can require careful handling of untrusted pull requests. No untrusted checkout or script-injection pattern was detected, so this is a workflow caution rather than a severe finding.

Project backingcaution

The repository is owned by an individual rather than an organization, so the project has a narrower apparent backing structure; this is partly offset by the established repository and named maintainers.

Release historycaution

The latest registry release was published over seven years ago, with no releases in the last year. The long release gap lowers confidence that this exact release receives ongoing maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the old release, this raises abandonment and update-capacity concerns.

Repo issue activitycaution

There are no open issues or pull requests and no activity in the last month. This is not inherently negative for a small stable utility, but it offers little evidence of active support.