It's safe.
Lots of people who haven't used GitHub make accounts to just submit text fixes to tools they use; they might not get involved with anything else hence their narrow contributions.
PKHeX.Core is available on NuGet, and the project has been on GitHub for years with a bunch of other repos consuming the PKHeX.Core dependency. Nothing to be worried about.