@listr2/prompt-adapter-inquirer

Build provenancecaution

The package uses staged publishing, but it has no build attestation or trusted-publisher provenance, leaving release origin less independently verifiable.

Repo toolingcaution

The repository uses TypeScript, npm scripts, and SWC, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No security policy was found in the linked repository, reducing transparency about vulnerability reporting and response.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts, script injections, or audit findings, but all 18 action references are unpinned. The unpinned references are a workflow hygiene and supply-chain reproducibility concern.