@a2a-js/sdk

Maintainerscaution

Three of five publishing accounts use the google.com domain, while herczyn and swapydapy publish through gmail.com accounts. Those personal publishing accounts are an account-hygiene caution, though the organization backing and company-domain majority partly compensate.

Repo toolingcaution

The project uses TypeScript, Vitest, tsup, esbuild, and npm scripts, but no security-scanning tools were detected. The repository's separate security policy helps transparency but does not replace automated scanning.

Workflow auditcaution

The audit covered all 16 workflows with no untrusted checkouts or script-injection findings, but 61 of 63 action uses are unpinned and several low-confidence cache-poisoning patterns were reported. Top-level write permissions in five workflows add mild hygiene risk, without evidence of an exploitable trigger-and-sink combination.