plugin/openklacht

Package scaffoldingcaution

The artifact includes a changelog and release notes for this exact version, while the repository has tests and a changelog. The missing packaged README is a real consumer-documentation gap for a plugin, though repository evidence shows the project is documented through its development files.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, although the clean workflow profile and Dependabot coverage provide some compensating security practice.

Token permissionscaution

None of the four workflows declares top-level token permissions, which is weaker workflow hardening. However, none declares top-level write access, so the observed risk is limited.