bear/sunday

Lifecycle scriptscaution

The package uses post-install-cmd and post-update-cmd scripts; these add install-time behavior and therefore warrant review, although the signal does not establish that the scripts are unsafe.

Repo bus factorcaution

One contributor made 12 of 13 recent commits, a 92.3% share, which creates a real concentration risk. Organizational ownership and a second active contributor partly compensate, so this is caution rather than severe risk.

Token permissionscaution

All 4 workflows lack top-level token permissions declarations. Although none declares top-level write access, explicit least-privilege permissions would provide stronger CI security hygiene.