luany/cli

Lifecycle scriptscaution

A post-install-cmd script runs during installation. Install-time execution is relevant supply-chain exposure for a CLI package, although this signal alone does not show harmful behavior.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. This is a meaningful maintenance concern, despite the recent release history.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. That is a hygiene gap for a package with install-time execution, not evidence of abandonment by itself.

Workflow auditcaution

The single workflow was fully analyzed with no detected sinks or audit findings, and it has no top-level write permissions. However, all six action references are unpinned, leaving builds exposed to moving action revisions.