cleaniquecoders/laravel-scheduler-manager

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a supply-chain hygiene consideration, but the signal provides no evidence that the script is unusually risky.

Release historycaution

This is a very new package, only 31 days old, with three releases concentrated within one day. That shows active initial work but provides limited evidence of long-term maintenance.

Security policycaution

The repository has no security policy. For a package that runs scheduled commands and includes an administrative UI, this is a real transparency and vulnerability-reporting gap.

Workflow auditcaution

All 15 analyzed action references are unpinned, weakening build reproducibility, and the auditor found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is caution rather than danger.