ami-praha-a-s/ami-ai-skills

Dangerous workflowscaution

One of four workflows uses pull_request_target for Dependabot auto-merge, which warrants review because that trigger has elevated workflow context; no untrusted checkout or script-injection patterns were detected.

Release historycaution

The package is only 147 days old with 4 releases and a median release interval of about 53 days. This shows ongoing publication but provides limited evidence of long-term maintenance maturity.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last 3 months. The recent push and open pull requests provide some compensating evidence, but the lack of observed commit activity remains a meaningful maintenance concern.

Security policycaution

No repository security policy was found, reducing transparency for vulnerability reporting and response expectations.

Token permissionscaution

Three workflows declare top-level write permissions and one workflow lacks top-level permissions, leaving broader-than-necessary or unclear CI token authority that should be reviewed.