@chakra-ui/theme-tools

Repo package mentioncaution

The repository name does not match the package and its README does not mention this package, so the package-to-repository relationship is less transparent; the organization match provides some compensation.

Repo toolingcaution

The repository uses established build tools, but no security-scanning tools were detected; the missing scanning is a modest hygiene gap rather than evidence of abandonment.

Workflow auditcaution

All nine analyzed action references are unpinned, creating avoidable build reproducibility and action-substitution risk. The audit found no untrusted checkouts, script injection, or high-severity findings, and only one workflow has top-level write permissions.