libresign/behat-builtin-extension

Lifecycle scriptscaution

The package declares post-install and post-update scripts. These increase installation complexity and deserve review, although the signal does not show that the scripts are harmful.

Security policycaution

The repository has no published security policy. That is a transparency gap for reporting vulnerabilities, though the presence of Dependabot and Psalm provides partial compensating evidence.

Workflow auditcaution

All five workflows were analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, 10 of 12 action references are unpinned, leaving a meaningful reproducibility and action-supply-chain hygiene gap.