netresearch/sdk-api-universal-messenger

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can require careful handling of untrusted pull requests; no untrusted checkout or script-injection patterns were detected.

Dependency profilecaution

The SDK declares 19 runtime dependencies, including several HTTP and serialization interfaces; this is a meaningful dependency surface but is consistent with the package's API-client role.

Maintainerscaution

Only one account has registry publish access, which is a narrow publishing base; the concern is partly offset by the linked organization-owned repository and recent activity.

Token permissionscaution

Both workflows declare top-level permissions, but one grants write access; explicit scoping is better than an undeclared default, though write capability increases automation exposure.