skin-tone

Project backingcaution

The repository is owned by a single user rather than an organization, so continuity depends on a relatively narrow project owner base. Other evidence, including the established package and linked repository, partly offsets that concern.

Release historycaution

The package has 7 releases since June 2016, but no releases in the last 12 months and the latest release was over two years ago. This suggests slower maintenance, although the package is mature and small.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. The package is small and recently published historically, but the observed activity still limits confidence in ongoing maintenance.

Repo toolingcaution

The repository uses no build tool or security scanning tool. This is a modest transparency and maintenance gap for a small package, not evidence that the release is unfit.

Workflow auditcaution

The only workflow was fully analyzed with no dangerous triggers or audit findings, but both action references are unpinned. That leaves the workflow exposed to upstream action changes and warrants a hygiene caution.