Documentation, tests, release notes, and security tooling are in place. It remains a beta release, and all 28 workflow actions are unpinned, so pinning a specific version is prudent.
82%
Total Score
100
100
89
100
The repository has only one star and no forks, so external adoption evidence is limited; popularity is supporting evidence rather than a health verdict.
All recent releases are prereleases and the assessed version is beta, so API or behavior changes remain more likely than for a stable release.
The sole workflow was fully analyzed with no untrusted checkouts or script injection, but all 28 action references are unpinned. The cache-poisoning findings are low-confidence hygiene warnings, not standalone severe evidence.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
waffle-commons/contracts Version self.version | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.