quadrubo/filament-model-settings

Maintainerscaution

Only one registry account has publish access. That is a thin publishing base for a user-owned project and leaves limited visible redundancy if the maintainer becomes unavailable.

Project backingcaution

The repository is owned by a user account rather than an organization, so there is no observed organizational backing to offset the single-maintainer and inactive-commit concerns.

Repo commit activitycaution

There were zero commits and zero active maintainers in the past three months. This is a meaningful maintenance concern, though the January 2026 release shows the project was recently updated.

Repo issue activitycaution

There is only one open issue and one open pull request, with no new or closed activity in the past month. The small queue is not severe, but the lack of recent movement reinforces the maintenance concern.

Workflow auditcaution

All six workflows were analyzed, but all 13 action references are unpinned and a high-confidence bot-conditions finding reports that actor context may be spoofable. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is workflow hygiene risk rather than a severe standalone dependency risk.