statamic-addon/color-scheme

Licensecaution

The release declares a proprietary license, so it is licensed rather than unlicensed; however, its proprietary terms may require developers to verify usage rights before adoption.

Package scaffoldingcaution

The package has no README, tests, changelog, or release notes. Missing tests and changelog are normal for a published artifact, but the absent README reduces consumer-facing transparency for an integration-focused addon.

Repo toolingcaution

Composer is used for builds, but no security scanning tool is reported. For a small addon this is a modest transparency gap, not evidence of unsafe code.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented. This is a maintenance and transparency gap, but not a severe dependency risk on its own.

Workflow auditcaution

The single workflow is fully analyzed and has no reported dangerous sinks or audit findings, but its only action reference is unpinned, so the workflow does not fully protect against action-reference drift.