1994/ghostwriter-core

Release historycaution

The package was first released today and has three releases so far, including this version. That shows active initial development but provides little evidence of long-term maintenance.

Repo commit activitycaution

No commits are recorded over the last three months, but the repository is brand new and was pushed recently; three pull requests were merged in the last month. The short history limits confidence without showing abandonment.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear. This is a modest transparency gap for a package handling AI-provider integrations.

Version stabilitycaution

v0.2.0 is not a stable major release, so compatibility may change under the documented 0.x policy. It is not marked as a prerelease, which partly offsets the concern.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no untrusted checkout or injection findings. Both of its action references are unpinned, leaving avoidable supply-chain drift risk.