k2gl/sigstore-sign

Dangerous workflowscaution

Three workflows were analyzed with one pull_request_target workflow, but no untrusted checkouts or script-injection patterns were detected. The pull_request_target workflow still warrants review because it can be security-sensitive.

Dependency profilecaution

Eight runtime dependencies, including several package-specific Sigstore components, create a meaningful transitive dependency surface that should be reviewed, though the count is not excessive for this functionality.

Maintainerscaution

Only one registry account has publish access. This is a publishing continuity risk for a user-owned project, although repository activity confirms that the account is currently active.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no shown organizational maintenance redundancy to offset the concentrated contributor base.

Release historycaution

The package is young at 61 days with 8 releases, including 7 in the last 12 months; this shows active iteration but provides limited long-term maintenance history.