@rc-component/motion

Lifecycle scriptscaution

A prepare script runs during package installation or preparation, adding some execution complexity, but this signal alone does not indicate an unsafe or unusual dependency.

Security policycaution

The repository has no SECURITY.md policy, leaving vulnerability-reporting expectations less explicit despite its other security scanning tools.

Workflow auditcaution

All 5 workflows were analyzed with no reported audit findings or untrusted checkout/script-injection sinks. However, 5 of 10 action references are unpinned and 3 workflows grant top-level write permissions, creating modest reproducibility and token-scope concerns.