skaut/wordpress-stubs

Repo bus factorcaution

All 8 recent commits came from one contributor, so maintenance continuity depends on a single person. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting and handling security issues, though it does not by itself indicate abandonment.

Workflow auditcaution

Both workflows were analyzed successfully, but all 6 action references are unpinned, one workflow grants top-level write access, and a high-confidence bot-conditions finding reports spoofable actor context. The pull_request_target trigger has no untrusted checkout or script-injection sink, so these are workflow-hygiene concerns rather than a severe standalone risk.