juvo/wordpress-plugin-boilerplate

Licensecaution

The artifact includes a license file, but the manifest declares GPL-3.0-or-later while the file is detected as GPL-2.0. The package is licensed, though the mismatch needs clarification before adoption.

Repo bus factorcaution

One contributor made all recent commits, so current maintenance is concentrated in a single person. The repository owner is an individual rather than an organization, leaving no demonstrated organizational handoff.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, indicating that recent development has slowed despite the broader release history.

Security policycaution

The linked repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled.

Workflow auditcaution

All 18 analyzed action references are unpinned, and the audit found three high-confidence template-injection findings in deploy and setup workflows. The workflows have no pull_request_target or workflow_run triggers and no untrusted checkouts, so these are workflow-hygiene concerns rather than an independent severe risk.