@storybook/manager-api

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the otherwise strong project evidence.

Dangerous workflowscaution

Three workflows use pull_request_target, which warrants review because that trigger can expose elevated privileges, but no untrusted checkout or script-injection patterns were detected across the 19 analyzed workflows.

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention @storybook/manager-api, so the package-to-repository relationship is less transparent; the monorepo structure partly explains the name mismatch but not the absent README mention.

Token permissionscaution

Most workflows use read-only or job-level permissions, but 4 workflows lack top-level permissions and 4 declare top-level write access, creating a modest workflow-hardening gap.