lindemannrock/craft-sms-manager

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts. These add execution during dependency operations, but the signal provides no evidence that the scripts are unsafe.

Repo bus factorcaution

All 38 recent commits came from one contributor, creating a real continuity risk. Organization ownership provides some ability to hand off maintenance, so this is caution rather than severe risk.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a modest transparency and maintenance gap, not evidence that the release is unsafe.

Workflow auditcaution

All three workflows were analyzed with no audit findings or untrusted checkouts, but all six action references are unpinned and two workflows grant top-level write permissions. These are workflow-hygiene concerns without a demonstrated untrusted path.