clawpdf

Build provenancecaution

No attestation, trusted publisher identity, or staged publishing is reported, leaving the relationship between source and published artifact less independently verifiable.

Dangerous workflowscaution

One of three workflows uses pull_request_target, which warrants review because it can execute with elevated repository context; however, no untrusted checkout or script-injection pattern was detected.

Maintainerscaution

Only one registry account has publish access, which creates publisher concentration risk, but the project_backing signal identifies an organization-owned repository, making a short registry maintainer list less concerning.

Repo toolingcaution

TypeScript and npm-based build tooling are present, but no security-scanning tools were detected, leaving a repository security-hygiene gap.

Token permissionscaution

All workflows declare top-level permissions and two are read-only, but pages.yml has top-level write permissions, increasing the potential impact of workflow compromise.