codebar-ag/laravel-flysystem-cloudinary-nova

Dangerous workflowscaution

One of seven workflows uses pull_request_target for Dependabot auto-merge, which warrants review because it operates with elevated workflow context. No untrusted checkouts or script-injection patterns were detected, limiting the concern.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a modest supply-chain and installation-complexity concern, though the available repository tooling provides some context for controlled maintenance.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. This is a real maintenance concern, although the package has recent releases and a push later in the period.

Token permissionscaution

Four workflows lack top-level token permissions and two declare top-level write access. Although only one workflow is explicitly read-only, this permissions posture is less restrictive than ideal.