seiger/stask

Project backingcaution

The repository is owned by an individual account rather than an organization, so the concentrated contributor activity represents a genuine continuity concern.

Repo bus factorcaution

Three contributors were active, but one supplied about 72% of recent commits. The second contributor remained active, partly reducing but not removing concentration risk.

Repo toolingcaution

Composer is used for builds, but no security-scanning tools were detected. This is a modest transparency and maintenance gap for a package handling background operations.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response guidance undocumented.

Workflow auditcaution

The single analyzed workflow has top-level write permissions and all five action references are unpinned. No untrusted checkout, script injection, or high-confidence audit finding was detected, so this is a hygiene caution rather than a severe risk.