eloquage/score

Dangerous workflowscaution

One workflow uses pull_request_target, which warrants review because it can run with elevated repository context, although no untrusted checkout or script-injection pattern was detected.

Release historycaution

This is a new package with one release published today, so there is no release track record from which to judge reliability or maintenance.

Repo commit activitycaution

The repository records zero commits and zero active maintainers in the last three months. Because the package was released today, this may reflect its very recent creation, but ongoing maintenance is not yet demonstrated.

Security policycaution

No security policy is present, leaving vulnerability-reporting expectations undocumented; this is a transparency gap for a new package.

Token permissionscaution

Three workflows request top-level write permissions and one lacks top-level permissions, increasing workflow privilege exposure compared with a least-privilege setup.