@storybook/csf-plugin

Repo package mentioncaution

The repository neither matches the package name nor mentions it in the README, which is a transparency caution; the organization-backed Storybook monorepo context partly explains the mismatch.

Workflow auditcaution

All 19 workflows were analyzed with no high- or medium-severity findings, no untrusted checkout or script-injection sinks, and all action references pinned. Two high-confidence low-severity findings install packages outside a lockfile, creating a modest reproducibility concern.