mage-os/module-meta-robots-tag

Repo bus factorcaution

All recent commits came from one contributor, giving the project a bus factor of one. Organization backing partly offsets handoff risk, but no second active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last three months, with one active maintainer. This is evidence of a thin recent maintenance footprint, despite the recent release.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning coverage is a modest transparency and hygiene concern.

Security policycaution

The repository has no security policy. For a Magento extension, this leaves vulnerability-reporting expectations unclear.

Workflow auditcaution

The only workflow uses pull_request_target with an untrusted checkout and an unpinned action, which creates workflow supply-chain and pull-request exposure. The audit found no script injection, dangerous permissions, or other scored findings, and the job-level permissions reduce the concern.