expo-clipboard

Build provenancecaution

The release has no build attestation or trusted-publisher identity, leaving publication provenance less independently verifiable despite the package's active project backing.

Repo package mentioncaution

The linked repository name does not match expo-clipboard and its README does not mention the package, so the package-to-repository relationship is less transparent than ideal. The organization-owned monorepo context partly explains the name mismatch but does not remove the documentation gap.

Token permissionscaution

Many analyzed workflows lack top-level permission declarations and six declare top-level write access, which is a workflow-hygiene concern; the absence of observed injection or untrusted-checkout patterns reduces its impact on package health.