defstudio/filament-column-length-limiter

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge, which warrants review because that trigger can operate with elevated repository context; no untrusted checkout or script-injection findings were detected.

Maintainerscaution

Only one account has registry publish access, which is a resilience concern, but the repository is owned by an organization, making a short registry maintainer list less concerning.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, indicating a recent maintenance pause despite the recent release history and July push.

Token permissionscaution

All three analyzed workflows declare top-level write permissions, which broadens the impact of a workflow compromise and is weaker than least-privilege configuration.