altis/advanced-security

Repo package mentioncaution

The repository name does not exactly match the package name and its README does not mention the package, so the package-to-source relationship is less explicit than expected despite the matching repository URL.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance less transparent for a security-focused package.

Workflow auditcaution

All seven analyzed action references are unpinned, and two high-confidence template-injection findings plus an ad hoc package installation weaken CI hygiene. The pull_request_target workflow has no untrusted checkout or script-injection finding, so this is caution rather than a severe dependency risk.