@walletconnect/sign-client

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some ownership ambiguity. However, the repository tree visibly contains the corresponding monorepo package structure, partly compensating for the generic repository-level README.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations less transparent for adopters.

Workflow auditcaution

All 11 workflows were analyzed, with no untrusted checkouts or script-injection findings, but 28 of 29 action references are unpinned and high-confidence template-injection findings affect canary publishing workflows. The low-confidence cache-poisoning finding is secondary, while the single top-level-write workflow adds limited exposure.