ibexa/commerce-skeleton

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts run during Composer operations, adding execution surface for consumers, though this is common for application skeletons.

Workflow auditcaution

All three workflows were analyzed, but all three action references are unpinned and high-confidence github-app and template-injection findings appear in two workflows. No untrusted checkout or script-injection trigger was found, limiting this to a hygiene concern rather than a severe dependency risk.