markdownlint

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving the relationship between source and published artifact less transparent.

Maintainerscaution

Only one registry account has publish access, creating publishing continuity risk, although repository activity shows the project is currently maintained.

Repo bus factorcaution

Two contributors were active, but one authored about 97% of recent commits, leaving maintenance highly concentrated and vulnerable to that contributor's unavailability.

Security policycaution

No repository security policy was found, reducing clarity about how vulnerabilities should be reported and handled.

Workflow auditcaution

All five workflows were analyzed without audit findings or untrusted-code sinks, and two scope permissions at job level; however, all 15 action references are unpinned, weakening workflow reproducibility and supply-chain hygiene.