restricted-input

Repo bus factorcaution

All two recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second recent contributor is shown to share the maintenance load.

Repo commit activitycaution

Only two commits came from one active maintainer in the last three months, indicating some activity but a thin recent maintenance pace.

Workflow auditcaution

All nine workflows were analyzed with no untrusted checkouts, script injection, or unpinned actions. However, the audit found a high-confidence template-injection issue and an archived action; without dangerous triggers these are workflow hygiene concerns rather than standalone severe risks.