ilovintit/hyperf-skeleton

Release historydanger

This package has only one release, with no release in about two years; that strongly suggests abandonment and leaves no evidence of ongoing maintenance.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing the long release gap rather than showing active upkeep.

Licensecaution

The manifest declares Apache-2.0 while the artifact and repository license files are detected as MIT. A license mismatch creates avoidable legal uncertainty despite the presence of license files.

Security policycaution

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities in a framework skeleton with multiple runtime dependencies.

Workflow auditcaution

All three analyzed action references are unpinned, and a high-confidence medium-severity finding identifies an archived action in the release workflow. The workflows have no untrusted triggers or dangerous checkout sinks, which limits the risk.