ibrahim-bougaoua/numbertowords

Workflow auditdanger

All five workflows were analyzed, but all 12 action references are unpinned, three workflows grant top-level write access, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so it is not independently dangerous.

Lifecycle scriptscaution

A post-autoload-dump script is present. This is a small installation-time complexity concern, but the signal alone does not indicate abandonment or unsafe maintenance.

Maintainerscaution

One registry maintainer is consistent with a small user-owned project, but it leaves limited visible publishing capacity if that maintainer becomes unavailable.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single registry maintainer provides no additional organizational backing.

Release historycaution

There has been only one release, published 807 days ago, with no releases in the last 12 months. That gives little evidence of sustained registry maintenance.