yard/nutshell

Lifecycle scriptscaution

The package uses a post-autoload-dump install-time script, which adds execution surface during installation. No dangerous workflow behavior was detected, but the script itself warrants review before adopting the dependency.

Package scaffoldingcaution

A substantial README is present, but both the artifact and repository report no tests or changelog. GitHub Releases are used, which partly compensates for the missing changelog, but the lack of visible tests remains a maintenance-hygiene gap.

Security policycaution

No SECURITY.md or equivalent security policy was found, reducing transparency around vulnerability reporting and response.

Token permissionscaution

All 6 workflows lack top-level token permissions declarations, although none declares top-level write permissions. Explicit least-privilege configuration would improve CI security hygiene.