sprint-digital/sawfish-integration

Workflow auditdanger

All six action references are unpinned, and a high-confidence, high-severity bot-conditions finding reports spoofable actor context in the Dependabot auto-merge workflow. Two workflows also grant top-level write access; the pull_request_target trigger has no untrusted checkout or script-injection sink shown.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a meaningful execution surface, but the signal provides no evidence that the script is unsafe.

Repo popularitycaution

The repository has no stars and one fork. This is weak supporting evidence, but popularity is not required for a small, actively maintained package.

Security policycaution

The repository has no security policy. That reduces vulnerability-reporting transparency, although Dependabot and active repository maintenance partly offset the gap.