rc-input

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable, although this is a transparency gap rather than evidence of an unhealthy project.

Lifecycle scriptscaution

A prepare install-time script is present, adding some installation complexity, but this signal alone does not show unsafe behavior.

Release historycaution

The package has 50 releases over roughly four and a half years, but it has had no registry release in the last 12 months. Recent repository activity partly compensates for the registry cadence gap.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations unclear; this is a minor transparency gap.

Workflow auditcaution

All four workflows were analyzed with no reported findings or untrusted checkouts, but three workflows grant top-level write permissions and four of six action references are unpinned. These are workflow hygiene concerns, not severe findings on their own.