crustum/plugin-manifest

Repo bus factorcaution

One contributor made all five recent commits, creating concentration risk; the organization-owned repository provides some capacity to hand maintenance off, but no second active contributor is shown.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the link does not clearly establish that this repository belongs to the published package.

Repo popularitycaution

The repository has one star and no forks or watchers. This is weak supporting evidence, but it does not outweigh the observed release and commit activity.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations less transparent than they could be.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers or audit findings, but all seven action references are unpinned, weakening build reproducibility and increasing dependency-change risk.