lindemannrock/craft-icon-manager

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, which add installation complexity and warrant caution even though no other provided signal shows those scripts are unsafe.

Repo bus factorcaution

All four recent commits came from one contributor, leaving maintenance dependent on a single active individual despite the organization-owned repository.

Workflow auditcaution

All three workflows were analyzed with no auditor findings or untrusted checkout/script-injection sinks. However, all six action references are unpinned, and two workflows use top-level write permissions, creating moderate workflow hygiene risk.