b10k/craft-component-check

Release historycaution

The package was first released today and has only three releases, so there is no meaningful long-term maintenance record yet.

Repo toolingcaution

Composer build tooling is present, but no repository security scanning tools were detected, leaving a modest assurance gap.

Security policycaution

The repository has no SECURITY policy, which reduces transparency for reporting and handling vulnerabilities in a package intended for development and CI use.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted triggers or script-injection sinks, but all five action references are unpinned and a high-confidence low-severity finding reports installing a package outside a lockfile. The two cache-poisoning findings are low confidence and therefore carry little weight.