cakephp/plugin-installer

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. Although a recent release and May 2026 push show the project is not abandoned, the current maintenance pace warrants caution.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. For a small Composer plugin this is a modest transparency gap rather than a severe risk.

Security policycaution

The repository has no published security policy. This weakens vulnerability-reporting transparency, although the package's clear ownership and established source repository provide some compensating context.

Workflow auditcaution

The single workflow was fully analyzed and uses read-only permissions, with no untrusted checkout or script-injection findings. However, both action references are unpinned and high-confidence secrets-inherit findings show credentials are passed more broadly than necessary, creating a workflow hygiene concern.