@swagger-api/apidom-parser-adapter-asyncapi-yaml-2

Dangerous workflowscaution

One workflow uses pull_request_target and two use workflow_run, which deserve review, but all seven workflows had no untrusted checkout and no script-injection findings, limiting the observed risk.

Dependency profilecaution

Seven runtime dependencies are declared, including related ApiDOM packages and the YAML adapter; this is a meaningful dependency surface but is coherent with the package's parser-adapter role.

Lifecycle scriptscaution

The package uses postpack and prepack lifecycle scripts, which add build and publication complexity and merit review, but these are packaging-oriented scripts rather than an inherently severe health risk.

Token permissionscaution

All seven workflows lack top-level permissions declarations, which weakens least-privilege clarity. However, none declares top-level write permissions, and two specify job-level permissions, so this is a hygiene caution rather than a severe finding.