solution-forest/workflow-engine-core

Dangerous workflowscaution

One of five workflows uses pull_request_target, which carries elevated automation risk, but no untrusted checkouts or script-injection patterns were detected. The overall workflow profile is therefore a manageable caution rather than a severe health concern.

Package scaffoldingcaution

The artifact and repository include a substantial README, tests, and changelog, which supports transparency and maintainability. However, the README explicitly states that the package is under active development and not ready for production, with potentially incomplete features and breaking changes.

Repo popularitycaution

The repository has 9 stars, 3 forks, and 0 watchers, so external adoption signals are modest. Popularity is supporting evidence only, and the active maintenance and organization backing compensate for this limited reach.

Token permissionscaution

Three workflows declare top-level write permissions, while two declare no top-level permissions. Broad write access increases workflow-maintenance risk, even though no untrusted checkout or script-injection issue was found.

Version stabilitycaution

The assessed version is a stable major release and is not marked prerelease, but two-thirds of recent releases were prereleases. That pattern indicates continuing API or feature churn despite the current stable label.