saade/filament-autograph

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This adds some installation complexity, but the signal provides no evidence that the script is unusually risky.

Project backingcaution

The package and repository are owned by the same individual account rather than an organization, so the concentrated maintainer activity represents genuine continuity risk.

Repo bus factorcaution

One contributor made 100% of the two recent commits, leaving the project dependent on one person's continued availability.

Repo commit activitycaution

Only two commits were recorded in the last three months, so maintenance activity is present but fairly light for a package with a single active contributor.

Workflow auditcaution

All five workflows were analyzed successfully, all 12 action references are pinned, and no untrusted checkout or script-injection sinks were found. A high-confidence bot-conditions finding and broad top-level write permissions warrant a minor workflow-hygiene caveat, without evidence of a severe release-path risk.