cognesy/instructor-tell

Repo bus factorcaution

One contributor made all 38 commits in the last three months, leaving a concentrated maintenance base. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. This is a modest transparency and maintenance-process gap rather than a severe risk.

Security policycaution

The repository has no security policy. For a CLI that handles credentials and can run tools, this weakens vulnerability-reporting transparency.

Workflow auditcaution

The sole workflow uses a pull_request_target trigger without an untrusted checkout or script-injection sink, so the trigger is not dangerous here. Its one action is unpinned, creating a workflow reproducibility and supply-chain hygiene gap.