thinwrap/llm

Release historycaution

This is a young package, 57 days old with only two releases, so long-term maintenance and compatibility are not yet demonstrated.

Repo bus factorcaution

All five recent commits came from one contributor. The organization-owned repository provides some handoff capacity, so this is a maintainability concern but not a severe risk.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented for a package that handles provider credentials and network requests.

Workflow auditcaution

The audit found high-confidence template-injection patterns in the release workflow and a top-level write token, while no untrusted checkout or script-injection sink was found; two of four action references are unpinned. These are workflow hygiene concerns rather than standalone severe health risks.