friendsofhyperf/mysql-grammar-addon

Dangerous workflowscaution

One of two analyzed workflows uses pull_request_target, which can increase exposure to untrusted pull-request content even though no untrusted checkout or script injection was detected.

Repo commit activitycaution

No commits and no active maintainers were recorded during the last three months. This is a meaningful maintenance concern, although the recent release history provides some compensating evidence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a small package this is a hygiene gap rather than evidence of abandonment.

Token permissionscaution

Both workflows omit top-level token permissions, making least-privilege behavior less explicit. No workflow declares top-level write access, which limits the severity of this gap.