automattic/jetpack-shared-extension-utils

Repo toolingcaution

Composer is used as a build tool, but no repository security-scanning tools were detected; this is a modest transparency gap rather than evidence of unsafe code.

Workflow auditcaution

Both workflows were analyzed successfully, use three pinned actions, and contain no untrusted checkout or script-injection findings. However, the publisher workflow has top-level write permissions and a high-confidence adhoc-packages finding; the low-confidence cache-poisoning finding is hygiene rather than decisive risk.