uuid

Dangerous workflowscaution

One of four workflows uses pull_request_target with an untrusted checkout, creating a meaningful CI supply-chain exposure even though no script injection was detected.

Repo toolingcaution

The repository reports no detected build tool or security scanning tool. This is a transparency and automation gap, although active commits, repository tests, and signed publication provide compensating evidence.

Token permissionscaution

Two workflows declare read-only permissions, but one lacks top-level permissions and another declares top-level write access, leaving avoidable CI token exposure.