@shikijs/themes

Repo toolingcaution

The project uses established build and test tooling, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency for reporting and handling vulnerabilities even though other maintenance signals are strong.

Workflow auditcaution

All 13 workflow action references are unpinned, and high-confidence audits found several ad hoc package installs; the top-level write permission is limited to one workflow. The high-severity cache finding has low confidence, so it is only a modest hygiene concern.