lumnd/platoadmin

Lifecycle scriptscaution

The post-create-project-cmd hook is consistent with a project scaffold that needs setup after creation, but install-time code still adds operational complexity compared with a passive library.

Repo bus factorcaution

All 14 recent commits came from one contributor. Organization backing provides some handoff capacity, but no second active contributor is shown to reduce dependence on that individual.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a modest transparency and maintenance gap for a package with nine runtime dependencies.

Version stabilitycaution

The release is not marked prerelease, but the package remains on the 0.x series, so its API and behavior are less mature than a stable-major dependency.

Workflow auditcaution

Both workflows use read-only permissions and the audit completed cleanly with no untrusted checkouts or injection findings, but all 10 referenced actions are unpinned, weakening build reproducibility and supply-chain hygiene.