jardis/dev-skills

Repo bus factorcaution

All 45 recent commits came from one contributor, leaving a thin operational base. Organization backing partly compensates, but no second active contributor is shown.

Security policycaution

No repository security policy was found. This is a transparency gap for a Composer plugin that runs as part of installation and project setup.

Workflow auditcaution

All 11 action references are unpinned, and the audit found a high-confidence template-injection issue in auto-release.yml. No pull_request_target or workflow_run trigger or untrusted checkout was reported, so this is workflow hygiene risk rather than standalone critical evidence.