atoolo/runtime

Lifecycle scriptscaution

A post-install Composer script runs during installation, which adds execution complexity and deserves review, but this signal alone does not indicate abandonment or severe dependency risk.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance undocumented. This is a transparency gap, not evidence that the release is unsafe.

Workflow auditcaution

All four workflows were analyzed without high- or medium-severity findings, and none use dangerous untrusted triggers or sinks. However, all three analyzed action references are unpinned, which weakens build reproducibility and supply-chain hygiene.