hexo

Lifecycle scriptscaution

A prepare script runs during installation, which adds some install-time behavior but is not inherently concerning without evidence of unsafe actions.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting guidance unclear; this is a transparency gap despite the presence of automated dependency scanning.

Workflow auditcaution

All six workflows were analyzed and no untrusted checkout or script-injection sink was found, but 17 of 21 action references are unpinned and two workflows grant top-level write access. The reported github-env and cache-poisoning findings are low-confidence hygiene concerns, not standalone severe risks.