amethyst/sku

The MIT license, automated tests, and organization-backed repository improve transparency. Limited security tooling and sparse usage signals leave little evidence that problems would be found or addressed promptly.

Latest v0.2.1

Packagist

38%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was published more than six years ago, with no releases in the last 12 months. This is strong evidence of abandonment risk, despite the package having 10 releases overall.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap. This materially weakens evidence of ongoing maintenance.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. That is a meaningful assurance gap for a package with no recent maintenance activity.

Security policy

The repository has no security policy, leaving no documented process for reporting or handling vulnerabilities. The absence of security scanning in the repository provides no compensating evidence.

Workflow audit

All three workflows were analyzed, but all six action references are unpinned and the audit found a high-confidence, high-severity unpinned container image in the test workflow. This weakens build reproducibility and CI supply-chain hygiene.