altis/local-server

Workflow auditdanger

Both template-injection findings were high-confidence and high-severity in release and tagging workflows, while all seven action references are unpinned and one workflow installs an ad hoc package. The pull_request_target workflow had no untrusted checkout or script-injection sink, so that trigger is not independently dangerous.

Licensecaution

The manifest declares GPL-2.0-or-later, but the artifact contains an MIT license file under docker; the mismatch creates licensing ambiguity despite the presence of a license file.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and response procedures less transparent.