genepeng/qiyukf

Package scaffoldingcaution

The artifact includes a README, but it is only 28 characters long and provides little integration guidance. The absence of tests and a changelog in the published package is normal packaging practice and is not a gap by itself.

Release historycaution

The package has only one release, published about 10 years ago, with no releases in the last 12 months. That is strong evidence of abandonment risk for a dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, and its last push was about 6 years ago. The lack of recent work materially lowers confidence in maintenance.

Security policycaution

The linked repository has no security policy, leaving no stated process for reporting or handling vulnerabilities. This is a transparency and maintenance gap, though it is not severe on its own.

Workflow auditcaution

The single analyzed workflow is complete and has no reported audit findings or untrusted execution paths, but its only action use is unpinned. That creates a modest reproducibility and supply-chain hygiene concern.