@openclaw/crabline

Lifecycle scriptscaution

The package runs a prepare script during installation. This is worth noting because install-time scripts add build behavior, but the available signals do not show that the script is unsafe or unusually complex.

Version stabilitycaution

Version 0.1.29 is not a stable-major release, so its API may still evolve. It is not a prerelease and recent releases contain no prerelease versions, which partly offsets that maturity concern.

Workflow auditcaution

All six workflows were analyzed, all 22 action references are pinned, and five workflows use read-only permissions. High-confidence adhoc package-install findings and one workflow with top-level write permissions are workflow hygiene concerns, but there is no untrusted checkout or script injection path; the low-confidence cache findings carry little weight.