capell-app/ai-orchestrator

Workflow auditdanger

The only workflow uses pull_request_target with an untrusted checkout and top-level write permissions; although no audit findings were reported, that combination increases the impact of compromised or malicious pull requests.

Licensecaution

The package declares a proprietary license and has no license file, which conflicts with open-source dependency expectations and may restrict downstream use.

Repo bus factorcaution

All 17 commits in the last 3 months came from one contributor, creating concentrated maintenance risk. Organization ownership provides some ability to hand off work, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools are reported, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented for a package that handles AI execution and provider integrations.