globals

Lifecycle scriptscaution

A prepare lifecycle script runs during installation or preparation. This is not necessarily unsafe, but it adds execution behavior that a dependency without lifecycle scripts would avoid.

Workflow auditcaution

Both workflows were analyzed with no untrusted checkouts or script injection, but all 23 action references are unpinned and the update workflow has high-confidence findings for installing packages outside a lockfile. One workflow also grants top-level write permissions, so workflow reproducibility and least-privilege hygiene warrant caution.