file-selector

Lifecycle scriptscaution

An install-time prepare script adds some supply-chain and installation complexity, but this signal alone does not show harmful behavior.

Repo bus factorcaution

One contributor made all 16 commits in the last 3 months, creating a real continuity risk; organizational ownership partly offsets this concentration.

Security policycaution

No repository security policy was found, which is a modest transparency gap for reporting vulnerabilities.

Workflow auditcaution

All six workflows were analyzed with no untrusted checkout or script-injection findings, but all 23 action references are unpinned, three workflows grant top-level write access, and a high-confidence bot-conditions finding remains.