@google/adk

Build provenancecaution

The release has no build attestation or trusted-publisher identity. This reduces publication transparency, although it is not by itself evidence of an unsafe release.

Maintainerscaution

Two of the three publishing accounts use the Google domain, consistent with the organization-backed repository. mrdoob (mrdoob.com) is an outside-domain publishing account, which is a modest account-hygiene concern rather than evidence of weak maintenance capacity.

Repo toolingcaution

The project uses TypeScript, Vitest, npm scripts, and esbuild, but no security-scanning tools were detected. The missing scanner is a minor hygiene gap because other maintenance evidence is strong.

Workflow auditcaution

All eight workflows were analyzed with no audit findings, untrusted checkouts, or script injections. However, 9 of 15 action references are unpinned and three workflows grant top-level write permissions; without an untrusted trigger or sink, this is a moderate workflow-hygiene concern, not a severe risk.