wp-cli/import-command

Dangerous workflowscaution

Two workflows use pull_request_target, which warrants review because that trigger can grant elevated context, but the scan found no untrusted checkout or script-injection patterns.

Repo bus factorcaution

One contributor made 10 of 11 recent commits, creating a concentrated maintenance dependency; the second active contributor and organization backing partly offset, but do not eliminate, this risk.

Token permissionscaution

Five of eight workflows declare top-level write permissions and two declare no top-level permissions, leaving broader automation privileges than necessary as a supply-chain hygiene concern.