bartlett/captainhook-bin-plugin

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no demonstrated organizational maintenance backup for the single registry maintainer.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which weakens evidence of ongoing maintenance after the recent release.

Repo toolingcaution

Composer and Box provide build tooling, but no security-scanning tool was detected, leaving a transparency and review gap.

Security policycaution

The repository has no security policy, so users are given no documented reporting or response process.

Workflow auditcaution

All 16 action references are unpinned, and the release workflow has a high-confidence template-injection finding; the low-confidence cache-poisoning finding is only a hygiene concern, but together the workflow controls are weaker than desirable.