johannschopplich/kirby-copilot

Dependency profilecaution

Seven runtime dependencies, including multiple AI provider SDKs and utility packages, create meaningful update and compatibility surface, but the profile is still understandable for an AI integration plugin.

Repo bus factorcaution

All 147 recent commits came from one contributor, leaving a thin operational fallback if that person becomes unavailable.

Repo toolingcaution

The repository uses Composer build tooling, but no security-scanning tools were detected; the build setup is present while automated security coverage is limited.

Security policycaution

No security policy was found in the repository, leaving vulnerability-reporting expectations unclear for a package that integrates several external AI services.

Token permissionscaution

The release workflow declares top-level write permissions, which expands the potential impact of a compromised workflow even though dangerous workflow patterns were not detected.