atoolo/citygov-bundle

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. This is partly offset by a release on June 3, 2026, but it still indicates quiet recent development.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, leaving uncertainty about whether the linked repository is the intended source rather than a related project repository.

Security policycaution

The linked repository has no security policy. This is a transparency and vulnerability-reporting gap, although it does not by itself show unsafe code.

Workflow auditcaution

All three analyzed action references are unpinned, and one workflow has top-level write permissions; the pull_request_target workflow has no untrusted checkout or script-injection sink, so this remains a hygiene concern rather than a severe workflow risk.