sbuerk/theme-extension-development

Workflow auditdanger

All 32 analyzed action references are unpinned, and the publish workflow has high-confidence template-injection findings alongside a workflow_run trigger; this creates a meaningful release-workflow hygiene risk. The audit itself analyzed all six workflows without failures, but the workflow configuration still warrants caution.

Maintainerscaution

Only one registry account has publish access. This is consistent with the repository being owned by an individual, but it leaves little publishing redundancy.

Project backingcaution

The registry namespace and repository are owned by the individual user sbuerk rather than an organization, so the single-contributor and single-publisher concentration is not offset by visible organizational backing.

Release historycaution

The package has four releases in only 1 day, with a median interval of about 36 minutes. This shows active initial publication but provides too little history to establish long-term maintenance reliability.

Repo bus factorcaution

One contributor made all 151 commits in the last 3 months, leaving no demonstrated contributor redundancy and increasing continuity risk if that maintainer becomes unavailable.