@amplitude/plugin-autocapture-browser

Workflow auditdanger

All 11 workflows were analyzed, all 64 action references are pinned, and no untrusted checkout or script injection was found. However, three high-confidence findings report blanket app-token permissions in publish-v2.yml, creating a meaningful workflow-credential risk.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package. A monorepo mismatch alone is ordinary, but the lack of any README reference weakens confidence that this repository is the package's intended source.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting expectations unclear; this is a transparency gap despite the repository's other security tooling.