shiki

Repo toolingcaution

The project uses established build and test tooling, but no security-scanning tools were detected. This is a modest transparency and hygiene gap, not evidence of abandonment.

Security policycaution

No repository security policy was found. That weakens vulnerability-reporting transparency, although the active project and provenance provide compensating evidence for general maintenance health.

Workflow auditcaution

All 13 analyzed action references are unpinned, and high-confidence ad-hoc package installs were found in both CI and release workflows. The low-confidence cache-poisoning finding is hygiene only, but these combined workflow weaknesses warrant caution.