complex-heart/sdk

Dependency profilecaution

The package declares six runtime requirements, including three related Complex Heart components. This is consistent with a metapackage, though it increases the number of components that must remain maintained.

Repo bus factorcaution

One contributor made all commits in the last three months. Organization ownership offers some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last three months, showing limited recent development activity. The recent release provides some counterevidence, but the observed maintenance pace is still thin.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting and response expectations unclear.

Workflow auditcaution

All five analyzed action references are unpinned, which weakens build reproducibility. The audit also found high-confidence template-injection patterns, but template injection alone is workflow hygiene rather than a severe health risk here.