@tloncorp/tlon-skill

Lifecycle scriptscaution

A postinstall script runs during installation, which increases supply-chain exposure because installation executes package code; no compensating detail about that script's behavior was provided.

Maintainerscaution

Four of five publishing accounts use the tlon.io domain, consistent with the organization-backed project. The dnbrwstr Gmail publishing account is an account-hygiene concern, not evidence of a thin maintenance team.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @tloncorp/tlon-skill, so the package-to-source relationship is not transparent even though the owner matches.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response expectations.