eddiedale/index-theme

Repo bus factorcaution

Two contributors are active, although the leading contributor made 17 of 22 recent commits, or about 77%. The second contributor's five commits partly reduce the concentration concern.

Repo toolingcaution

Composer is used as a build tool, but no security scanning tool was detected. For this small theme, the missing scanner is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no SECURITY.md or other detected security policy. This weakens reporting transparency, though it is not by itself evidence that the package is unsafe.

Workflow auditcaution

The single workflow was fully audited with no untrusted checkout or script-injection trigger, but it grants top-level write permissions, leaves both action references unpinned, and has a high-confidence template-injection finding. These are avoidable CI hygiene and supply-chain weaknesses, although no dangerous trigger-and-sink combination was observed.