unique-filename

Repo bus factorcaution

All recent commits came from one contributor. The repository is organization-owned, which provides some handoff capacity, but no second recently active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last three months, indicating limited recent development activity. The recent release partly offsets this, but the low activity supports a maintenance caution.

Type declarationscaution

No type declarations are included. For a small JavaScript utility this is mainly a consumer ergonomics gap rather than evidence of maintenance or supply-chain risk.

Workflow auditcaution

The audit analyzed all eight workflows and found no untrusted checkout or script-injection trigger pairing, but all 38 action references are unpinned and four workflows grant top-level write access. High-confidence template-injection findings and a medium-confidence bot-condition finding are workflow hygiene concerns, not standalone severe risk without a dangerous trigger or sink.