kevariable/phpclaw-laravel

Dangerous workflowscaution

One of five workflows uses pull_request_target for Dependabot auto-merge. No untrusted checkouts or script-injection patterns were detected, but this privileged workflow deserves review.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a meaningful installation-time behavior that should be reviewed, although the signal alone does not show that it is harmful.

Project backingcaution

The package and repository are owned by the same individual account rather than an organization, so the single-maintainer concentration is not offset by visible organizational backing.

Release historycaution

This package is only 90 days old and has one release, so there is little evidence of sustained release maintenance or long-term stability.

Repo bus factorcaution

All 31 commits in the last 3 months came from one contributor, creating a substantial continuity risk if that contributor becomes unavailable.