sanmai/duoclock

Workflow auditdanger

All three workflows were analyzed, but all 9 action references are unpinned and a high-confidence template-injection finding may expand attacker-controlled input into code. Top-level write permissions in one workflow add mild exposure, although no untrusted checkout or script-injection path was found.

Maintainerscaution

One registry publishing account provides a limited publishing base; this is a maintenance-capacity concern for a user-owned project, though it does not by itself indicate abandonment.

Project backingcaution

The registry namespace and repository are owned by the same individual, confirming alignment but not organizational backing or redundancy.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, indicating a quiet development period; the recent push shown by repository status is a partial counterweight but not evidence of sustained activity.

Security policycaution

No repository security policy is present, leaving disclosure guidance undocumented; the repository's Dependabot and Psalm tooling partly compensates for this gap.