dmk/webkitpdf

Lifecycle scriptscaution

A post-autoload-dump lifecycle script runs during installation. Lifecycle code expands installation complexity and warrants some caution, although the signal gives no evidence that the script is unsafe.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. This is a meaningful maintenance concern, though recent registry releases and a non-archived repository provide partial compensation.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools are configured. The missing scanning coverage lowers transparency around dependency and build risks.

Security policycaution

The repository has no security policy. Consumers have no documented process for reporting vulnerabilities or understanding the project's security response.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, all 9 of 9 action references are unpinned, leaving the build exposed to future upstream action changes.