decodelabs/effigy

Repo bus factorcaution

One contributor made all four commits in the last three months, so maintenance depends heavily on a single active person. Organization ownership provides some handoff capacity but does not remove the concentration risk.

Repo commit activitycaution

The repository had four commits in the last three months, showing recent work, but all activity came from one maintainer. That creates some continuity risk despite the recent cadence.

Security policycaution

The repository has no security policy. This is a transparency and response-process gap, though it is not evidence that the package is unsafe.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, injection findings, or excessive top-level permissions. However, all seven action references are unpinned, leaving a supply-chain hygiene gap.