z-schema

Dangerous workflowscaution

One of five workflows contains a detected script-injection pattern, which is a workflow security concern even though no pull_request_target, workflow_run, or untrusted-checkout risks were found.

Lifecycle scriptscaution

A prepare install-time script is present, adding some install complexity; the available build and provenance signals provide context but do not remove that operational consideration.

Repo bus factorcaution

All 20 recent commits came from one contributor, creating a meaningful single-maintainer continuity risk for a user-owned project.

Security policycaution

No repository security policy was found, reducing transparency about how vulnerabilities should be reported and handled.

Token permissionscaution

Three workflows lack top-level permissions and one release workflow grants top-level write access, leaving room for tighter least-privilege workflow configuration.