cli-truncate

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving release origin less independently verifiable; this is a transparency limitation rather than evidence of unsafe behavior.

Repo toolingcaution

The repository has no detected build tool or security scanning tool, which limits automated assurance, though the package is small and other maintenance signals are positive.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. Both action references are unpinned, a minor reproducibility and supply-chain hygiene gap.