microman/kirby-files-from-url

Maintainerscaution

Only one registry account has publish access. That is a thin publishing base and increases continuity risk when no recent repository activity is observed.

Project backingcaution

The repository owner is recorded as a user account rather than an organization, so there is no provided evidence of organizational continuity. This modestly reinforces the thin-maintenance concern.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although a release was published during that period, the lack of observed source activity is a maintenance caution.

Security policycaution

The linked repository has no security policy. This is a transparency and vulnerability-reporting gap, though it is not evidence of a security defect by itself.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, sinks, or audit findings, but its one action use is unpinned. That leaves avoidable build-integrity risk despite the otherwise clean audit.