@stoplight/spectral-cli

Build provenancecaution

The release has no attestation or trusted-publisher provenance, leaving publication origin less independently verifiable. This is a transparency gap, not evidence that the release is unsafe by itself.

Dependency profilecaution

Twenty runtime dependencies create meaningful maintenance and transitive-risk surface for a CLI, but the profile is not by itself evidence of abandonment or an unfit release.

Lifecycle scriptscaution

A prepare script runs during installation, adding some install-time behavior that dependents should account for, but this is not severe on its own.

Repo toolingcaution

The project uses TypeScript, npm scripts, and SWC for builds, but no repository security-scanning tool was detected. The missing scanner is a modest hygiene gap.

Security policycaution

The repository has no SECURITY.md or other detected security policy, reducing transparency about vulnerability reporting and response.