wpmetabox/mb-divi-integrator

Workflow auditdanger

Both workflows were analyzed, but one high-confidence finding reports spoofable actor checks in the Dependabot auto-merge workflow. Both action references are also unpinned, and one workflow grants top-level write access, so release automation needs caution.

Licensecaution

The package declares GPL-3.0, while the artifact's recognized license text is MIT and no repository license file was found. This may reflect bundled dependency licensing, but the mismatch should be clarified before adoption.

Security policycaution

The linked repository has no security policy. For a WordPress integration package this reduces the transparency of vulnerability reporting, although recent repository activity and organizational backing provide some compensation.