properties-file

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is present, leaving publication provenance less transparent than ideal.

Lifecycle scriptscaution

A prepare lifecycle script runs during installation or publishing and deserves review because it expands install-time behavior, although this signal alone does not indicate an unhealthy package.

Security policycaution

No SECURITY.md or equivalent security policy was found, reducing vulnerability-reporting transparency, though this is a hygiene gap rather than evidence of abandonment.

Token permissionscaution

All three workflows lack top-level permissions declarations and use job-level permissions only, with no read-only workflow classification; this leaves permission intent less explicit and warrants caution.