global-agent

Maintainerscaution

Only one registry account has publish access, which limits publishing redundancy; the repository is also owned by an individual rather than an organization.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful maintenance warning despite the recent release.

Repo toolingcaution

The project uses TypeScript, Vitest, Babel, and npm build tooling, but no security-scanning tools are reported, leaving a modest security-hygiene gap.

Security policycaution

The repository has no security policy, so vulnerability reporting and response expectations are not documented.

Workflow auditcaution

All seven action references are unpinned, weakening workflow reproducibility. The reported typosquat finding has low confidence, so it is only a hygiene concern rather than evidence of a severe workflow risk.