illuminate/container

Dangerous workflowscaution

One workflow uses pull_request_target, which can require careful handling of untrusted pull requests. No untrusted checkout or script-injection pattern was detected, limiting the practical risk.

Package scaffoldingcaution

The published artifact and repository contain no README or tests, which reduces consumer guidance and visible verification for this library. Missing tests and changelog files in the artifact are normal packaging practice, but the repository-level absence remains a modest concern.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months, a meaningful maintenance warning. However, the package still published 22 releases in the last year and the repository was pushed recently, so this is not evidence of abandonment by itself.

Repo toolingcaution

Composer is used as the build tool, which fits the package ecosystem, but no security scanning tools were detected. The missing scanning automation is a modest process gap, not a direct health failure.

Security policycaution

The repository has no published security policy. This weakens vulnerability-reporting transparency, although it does not by itself indicate poor maintenance.