qalainau/filament-univer-sheet

Licensecaution

The artifact declares MIT and includes license files, so licensing is present; however, detected license text also includes Apache-2.0, which the declaration does not cover. The mismatch warrants clarification before adoption.

Maintainerscaution

Only one registry publishing account is listed, and the project is backed by a personal repository rather than an organization. This leaves a thin visible publishing base and increases continuity risk.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the past three months, despite the release being only about five months old. This is meaningful evidence of slowed maintenance, though the project is still unarchived and has a recent release.

Security policycaution

The linked repository has no security policy. This is a transparency and vulnerability-reporting gap, although the repository is active enough to remain unarchived.

Workflow auditcaution

The audit covered all 1 workflow and found no dangerous triggers or high-confidence findings, but all 6 action references are unpinned. That weakens build reproducibility and supply-chain hygiene.