starcitizentools/citizen-skin

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the package-to-source relationship is less transparent; this may reflect a monorepo-style subpackage but remains worth checking.

Workflow auditcaution

All 28 analyzed action references are unpinned, and two workflows grant top-level write permissions, creating a real workflow-hygiene concern. The high-confidence template-injection finding is worth review, while the low-confidence cache findings are only hygiene concerns; the audit otherwise completed fully with no untrusted checkouts or script injections.