automattic/wp-ai-evals

Release historycaution

The package is only 56 days old with two releases, both arriving within about 15 hours. That is limited evidence of long-term maintenance, although the repository shows recent development.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a modest repository hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures unclear.

Version stabilitycaution

Version 0.1.1 is an early, non-stable-major release, so APIs and behavior may still change substantially. The explicit release notes and active repository partly compensate for the maturity gap.

Workflow auditcaution

All 9 analyzed action references are unpinned, and one workflow grants top-level write permissions. The workflow_run trigger has no untrusted checkout or script-injection sink, so these remain hygiene concerns rather than a severe workflow risk.