aura/marshal

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. The build setup is established, while security-process coverage is limited.

Security policycaution

The repository has no security policy. This is a transparency and vulnerability-reporting gap, although it is not evidence that the package is unsafe.

Workflow auditcaution

Both workflows were analyzed without audit findings or dangerous triggers, and one scopes permissions at job level. However, all five action references are unpinned, leaving workflow builds exposed to upstream action changes.