@reown/appkit-common

Dangerous workflowscaution

One of 15 workflows uses pull_request_target, but no analyzed workflow checks out untrusted code or contains detected script injection. The isolated workflow pattern warrants awareness but is not severe on the available evidence.

Repo package mentioncaution

The repository name does not match the package name and the package name is not present in the README, which can indicate a monorepo subpackage or an incorrect repository association. Organization ownership and the substantial AppKit monorepo provide context, but the association is not explicit in this signal.

Security policycaution

No repository security policy was found. This weakens vulnerability-reporting transparency, although active maintenance and security scanning partly compensate.

Token permissionscaution

Seven workflows lack top-level permission declarations and four declare top-level write access. The repository has some read-only and job-level restrictions, but the inconsistent permission hygiene remains a supply-chain maintenance concern.