paparascaldev/sidekick

Licensecaution

The manifest declares GPL-2.0-or-later, while the artifact license file is detected as GPL-3.0. Both are copyleft licenses, but the mismatch creates a real legal and transparency concern.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-contributor activity shown by the bus-factor signal is not offset by clear organizational handoff capacity.

Repo bus factorcaution

All five recent commits came from one contributor, so maintenance knowledge and release capacity are concentrated in a single person. The active repository partly offsets this, but not the continuity risk.

Repo toolingcaution

Composer build tooling is present, but no repository security-scanning tool was detected. That is a modest process gap rather than evidence of unsafe code.

Workflow auditcaution

The only workflow was fully analyzed with no reported audit findings or unsafe untrusted triggers. However, both action references are unpinned, so their contents can change independently of this release.