isbinaryfile

Dangerous workflowscaution

One workflow uses pull_request_target, which requires careful review because it can run with elevated repository context; no untrusted checkout or script-injection patterns were detected.

Lifecycle scriptscaution

A prepare install-time script is present, which adds some execution surface during installation, though this signal alone does not show harmful behavior.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the project has a relatively narrow visible ownership base; other activity signals show ongoing release and pull-request work.

Repo commit activitycaution

There were no commits and no active maintainers in the three-month window, which is a maintenance concern, although the recent release and four merged pull requests provide partial compensating evidence.

Security policycaution

No SECURITY.md or equivalent security policy was found, leaving vulnerability-reporting expectations unclear for consumers.