@rc-component/drawer

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers have less evidence connecting the published artifact to its source build.

Lifecycle scriptscaution

A prepare install-time script is present, which adds build-time execution during installation and merits awareness, but this signal alone does not establish a serious dependency risk.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All four workflows were analyzed with no audit findings or untrusted checkout and injection sinks. However, four of six action references are unpinned and three workflows use top-level write permissions, creating modest reproducibility and least-privilege gaps.