intelligent-intern/king-ext

Workflow auditdanger

All three workflows were analyzed, but all 75 action references are unpinned. The release workflow also has a high-confidence script-injection finding and uses trusted publishing; these create material CI and release-chain hygiene concerns, although no untrusted checkout or dangerous trigger was reported.

Repo bus factorcaution

One contributor made about 97.7% of the 443 recent commits, creating concentration risk. The organization-owned project and a second active contributor partly compensate, but the maintenance base remains thin.

Repo toolingcaution

The project uses Make and Composer, but no security-scanning tooling was detected, leaving a meaningful security-process gap for a native extension.

Security policycaution

The repository has no published security policy, reducing transparency for reporting and handling vulnerabilities.

Version stabilitycaution

This release is a prerelease, and 87.5% of recent releases are prereleases, so consumers should expect a less settled API and more upgrade risk.