gocpa/space-healthcheck

Licensecaution

The artifact declares a proprietary license while its LICENSE.md is detected as Unlicense; although a license is present, the mismatch creates legal clarity risk.

Lifecycle scriptscaution

A post-autoload-dump install lifecycle script is used. This is normal Composer behavior but means installation executes package-defined code.

Repo popularitycaution

The repository has one star and one fork, indicating limited external adoption. Popularity is only supporting evidence, so this modestly reduces maturity confidence without outweighing active maintenance.

Security policycaution

The repository has no published security policy, leaving reporting and response expectations unclear for a package that handles deployment and infrastructure information.

Workflow auditcaution

All six workflows were analyzed, but all 15 action references are unpinned, three workflows grant top-level write access, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no reported untrusted checkout or script injection, so this is a hygiene and workflow-risk concern rather than a severe standalone verdict.