awcodes/filament-gravatar

Dangerous workflowscaution

One workflow uses pull_request_target for automated Dependabot merging. No untrusted checkouts or script-injection patterns were detected, so this is a workflow caution rather than a severe health risk.

Token permissionscaution

One workflow lacks top-level permissions and another grants top-level write access for automated dependency merging. This weakens least-privilege transparency and warrants caution despite the otherwise healthy repository.