slam/openspout-helper

Maintainerscaution

Only one account has registry publish access, which limits publishing redundancy. The repository is user-owned, so this is a real capacity concern rather than an organization-backed publishing arrangement.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. This is a meaningful maintenance concern, although the recent release history and recent repository push provide some counterevidence.

Repo toolingcaution

The project uses Composer and Make, but no security scanning tools were detected. This is a modest transparency and review gap, not evidence of unsafe behavior by itself.

Security policycaution

The repository has no security policy, leaving no stated process for reporting and handling vulnerabilities in a package used as a library.

Workflow auditcaution

The only workflow uses all 12 analyzed actions without pinning, and the audit found a high-confidence template-injection pattern. No untrusted checkout, dangerous trigger, or broad top-level write permission was observed, so this is a hygiene concern rather than a severe workflow risk.