ianrothmann/aininja-laravel-sdk

Dangerous workflowscaution

Five workflows were analyzed with one pull_request_target workflow, used for Dependabot auto-merge. No untrusted checkouts or script-injection patterns were detected, so the workflow setup warrants review but is not severe on the available evidence.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This adds installation behavior that should be reviewed, although the signal does not show a dangerous command or unusual script count.

Package scaffoldingcaution

The release includes a README and changelog, while the repository has tests and a changelog; the missing published tests are normal packaging practice. However, the README still contains prominent template text rather than package-specific documentation.

Project backingcaution

The registry namespace and repository owner match, so the package has consistent ownership backing. The owner is an individual account, making the single-person maintenance model more relevant.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance concern despite the package's recent release history.