opencode-antigravity-auth

Repository archiveddanger

The linked repository is archived even though it was pushed recently, making future maintenance and fixes unreliable. This is a severe abandonment risk for a dependency.

Repo bus factorcaution

One contributor made all three recent commits, leaving maintenance fully concentrated in a single person. The repository is user-owned, so no organizational backing compensates for this concentration.

Repo commit activitycaution

Only three commits were recorded in the last three months, indicating limited recent maintenance despite the package's frequent release history.

Security policycaution

The repository has no security policy, reducing transparency about how dependency and vulnerability reports should be handled. The available build provenance provides some compensating release evidence but does not replace a reporting process.

Workflow auditcaution

All 17 analyzed action references are unpinned, five workflows grant top-level write access, and high-confidence template-injection findings affect republishing and dist-tag workflows. No untrusted checkout or injection-trigger combination was reported, so this is serious workflow hygiene risk rather than a standalone critical finding.