gkh/gkh-rss-import

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no visible organizational handoff capacity to offset the concentrated contributor activity. Recent commits and releases provide some compensation.

Repo bus factorcaution

All 9 commits in the last 3 months came from one contributor, giving the project a single-person maintenance dependency. The active repository and recent releases compensate partly, but they do not remove the continuity risk.

Security policycaution

No repository security policy was found. For a package that processes external RSS or Atom content, the absence reduces vulnerability-reporting transparency, though it is not evidence of a vulnerability by itself.

Workflow auditcaution

All 3 workflows were analyzed successfully, but all 14 action references are unpinned. The audit also found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow and one workflow with top-level write permissions; the pull_request_target trigger has no untrusted checkout or script-injection sink.