read

Repo bus factorcaution

All recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is shown in this period.

Repo commit activitycaution

Only one commit was recorded in the last three months, indicating limited recent development activity; the recent release provides some compensation but does not remove the concern.

Workflow auditcaution

All 38 analyzed action references are unpinned, and the audit reports high-confidence template-injection findings plus a medium-confidence bot-condition finding; top-level write permissions in four workflows add exposure, although no untrusted checkout or script-injection trigger was found.