foxws/laravel-relatable

Lifecycle scriptscaution

The package uses a post-autoload-dump install-time script. This deserves awareness during installation, but the signal alone does not show an unsafe or unusually broad action.

Release historycaution

The package is only four days old with two releases, so its long-term maintenance and compatibility record are not yet established.

Workflow auditcaution

All three workflows were analyzed with no audit findings or untrusted checkout and script-injection sinks. However, all eight action references are unpinned, and two workflows grant top-level write permissions, creating a modest reproducibility and token-scope weakness.