johannschopplich/kirby-helpers

Repo bus factorcaution

One contributor made all 24 commits in the last 3 months, giving the project a complete single-contributor concentration. The individual project backing provides no organizational handoff signal, so this is a real maintenance-continuity concern.

Security policycaution

The repository has no security policy. This is a transparency and vulnerability-reporting gap, though it does not by itself indicate that the package is unsafe.

Workflow auditcaution

The sole workflow gives every workflow top-level write permission and all 3 action references are unpinned. The auditor also reported a high-severity cache-poisoning pattern, but with low confidence and no untrusted checkout or script-injection sink, so this remains a hygiene concern rather than a severe workflow risk.