proggy

Repo bus factorcaution

All recent commits came from one contributor, creating concentration risk; organization ownership provides some ability to hand maintenance to others but does not remove the current thin activity.

Repo commit activitycaution

Only one commit was made in the last three months by one active maintainer, which is thin recent activity for a maintained dependency.

Workflow auditcaution

All 38 analyzed action references are unpinned, and high-confidence template-injection findings affect two workflows; four workflows also grant top-level write permissions. No untrusted checkout or script-injection trigger was found, so this is a material hygiene concern rather than a standalone severe risk.