powershell-utils

Build provenancecaution

No build attestation or trusted-publisher provenance was reported, so consumers cannot verify how this artifact was produced. The otherwise small dependency profile and active matching repository partly reduce the concern.

Repo bus factorcaution

All four recent commits came from one contributor, so maintenance depends heavily on a single person and has limited redundancy.

Repo toolingcaution

The project uses TypeScript, but no security-scanning tool was detected. That is a modest transparency and maintenance gap rather than evidence of abandonment.

Workflow auditcaution

The single workflow was fully analyzed with no risky audit findings, untrusted checkouts, or script injections. Both action references are unpinned, leaving a small reproducibility and action-integrity gap.