@reown/appkit-scaffold-ui

Dangerous workflowscaution

One of 15 workflows uses pull_request_target, but there are no untrusted checkouts or detected script injections; the isolated workflow warrants awareness rather than a severe concern.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it, so the package-to-repository relationship is less transparent; the organization backing and large monorepo-style file tree partly compensate.

Security policycaution

No SECURITY.md or equivalent security policy was found, leaving vulnerability-reporting expectations unclear for a package with substantial integrations.

Token permissionscaution

Seven workflows omit top-level token permissions and four declare top-level write access, creating avoidable CI permission risk despite other workflows using read-only or job-level permissions.

Version stabilitycaution

Version 1.8.24 is a stable major and not a prerelease, although the recent prerelease share is high at 95%, which adds some release-process caution.