divinea-labs/laravel-swisseph

Dangerous workflowscaution

One workflow uses pull_request_target, which warrants review because that event can expose elevated repository context. No untrusted checkouts or script-injection patterns were detected, limiting the concern.

Lifecycle scriptscaution

A post-autoload-dump install-time script runs during installation, adding some supply-chain and install behavior to review, though this signal alone does not show harmful behavior.

Repo popularitycaution

The repository has zero stars, forks, and watchers, indicating little visible adoption or external review. This is supporting caution rather than a decisive health failure for a young package.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and disclosure expectations undocumented.

Token permissionscaution

Three workflows declare top-level write permissions and two declare no top-level permissions, increasing workflow privilege ambiguity. The repository's active tooling partly compensates, but least-privilege configuration is not consistently evident.