@secretlint/source-creator

Lifecycle scriptscaution

A prepublish lifecycle script is present, adding some build-time behavior, but this is less concerning than an install-time script and is offset by the package's build provenance.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, so the linkage is less explicit; the organization-owned monorepo context partly explains the mismatch but does not remove the transparency concern.

Workflow auditcaution

All 8 workflows were analyzed, all 53 action references are pinned, and no untrusted checkout or script-injection paths were found. One high-confidence medium finding identifies an archived action, which is a workflow maintenance concern but not a release-blocking risk.