foxws/laravel-modelcache

Dangerous workflowscaution

One workflow uses pull_request_target, which can be sensitive because it runs with elevated repository context. No untrusted checkouts or script-injection patterns were detected, limiting the concern.

Lifecycle scriptscaution

A post-autoload-dump install-time script is present, so installation performs extra package actions and deserves review, but this is a common Composer lifecycle hook and is not by itself a sign of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures undocumented.

Token permissionscaution

Three workflows declare top-level write permissions and two declare no top-level permissions, which is broader or less explicit than ideal for CI hardening. This is a repository hygiene concern rather than evidence that the package is unmaintained.