cjmellor/approval

Lifecycle scriptscaution

A post-autoload-dump install-time script is present. This is a modest supply-chain and installation-complexity consideration, but the signal does not show dangerous behavior by itself.

Project backingcaution

The registry and repository are owned by the same individual, so there is no ownership mismatch; the single-person backing still limits redundancy compared with an organization.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months. Recent pull-request merges and a repository push partly offset this, but commit-level evidence of sustained maintenance is limited.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations unclear for a package used in application data workflows.

Workflow auditcaution

The audit found a high-confidence bot-conditions issue in a pull_request_target workflow, plus all six action references are unpinned and one workflow has top-level write permissions. No untrusted checkout or script-injection sink was found, so this is a workflow-hygiene caution rather than a standalone severe risk.