aeliot/todo-registrar

Dependency profilecaution

The release declares 26 runtime dependencies, a broad dependency surface for a command-line integration tool that increases maintenance and transitive-risk exposure.

Project backingcaution

The repository is user-owned rather than organization-owned, so the single-maintainer concentration provides no demonstrated organizational handoff capacity.

Repo bus factorcaution

One contributor made all 5 recent commits, leaving the project dependent on a single individual for current maintenance capacity.

Repo issue activitycaution

There are 7 open issues and no recent issue or pull-request activity, which is a modest transparency concern despite the recent release.

Workflow auditcaution

The audit analyzed all 7 workflows, but 36 of 37 action references are unpinned and it found high-confidence template-injection findings in release workflows; the low-confidence cache findings are hygiene only, and no dangerous trigger or untrusted checkout was reported.