tocbot

Maintainerscaution

Only one registry account, tscanlin, has publish access. The linked repository is user-owned rather than organization-backed, so there is limited visible publishing redundancy.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful sign of recently stalled maintenance despite the current release.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

All 11 action references are unpinned, and the audit found a high-severity cache-poisoning pattern at low confidence plus a high-confidence archived action. The workflows have no untrusted checkout or script-injection findings, which limits the overall impact.