b7s/fluentvox

Project backingcaution

The registry namespace and repository are owned by the same individual account, and the package repository matches and mentions the package, confirming source alignment but not providing organizational maintenance depth.

Repo bus factorcaution

One contributor made all commits in the last three months, leaving maintenance highly dependent on a single person; the repository is user-owned rather than organization-owned, so no organizational handoff is evidenced.

Repo commit activitycaution

Only two commits were recorded in the last three months, which shows some recent activity but a thin maintenance pace for a package that released frequently.

Security policycaution

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities in a package that runs external tools and manages downloaded models.

Workflow auditcaution

The sole workflow grants top-level write permissions and all four action references are unpinned. The auditor also reported a low-confidence cache-poisoning pattern; that finding is hygiene rather than a severe risk on its own.