yaml-eslint-parser

Project backingcaution

The repository is owned by an individual rather than an organization, so the maintenance capacity rests on a relatively narrow project owner base; recent activity partly offsets that concern.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security scanning tools were detected; this is a modest security-process gap rather than an abandonment concern.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The audit analyzed all six workflows with no detected injection or untrusted-checkout findings, but all 26 action references are unpinned and two workflows grant top-level write permissions. These are workflow hygiene risks, not severe evidence on their own.