hyperf/contract

Dangerous workflowscaution

One of two analyzed workflows uses pull_request_target, which can increase workflow risk when handling untrusted pull requests. No untrusted checkout or script-injection patterns were detected, so this is a caution rather than a severe risk.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. This conflicts with the recent release history and is a meaningful maintenance-risk signal, though it does not yet establish abandonment.

Repo toolingcaution

Composer is used as the build tool, but no security scanning tools were detected. The missing scanning is a transparency gap, while the package's small, dependency-light structure limits its practical significance.

Token permissionscaution

Both workflows lack top-level token permissions declarations. No workflow requests top-level write permissions, which reduces the concern, but explicit least-privilege configuration is still missing.