manticoresoftware/buddy-core

Dangerous workflowscaution

One of two workflows contains a detected script-injection risk. No pull-request-target or untrusted-checkout workflow risks were found, which limits but does not remove the concern.

Package scaffoldingcaution

The package includes tests, which supports basic project maturity, but its 14-character README gives consumers almost no integration guidance. The absent changelog is not a concern because changelogs belong in the repository and are not expected in every published artifact.

Release historycaution

This release is the package's only registry release, published over two years ago, with no releases in the last 12 months. Recent repository commits provide some compensation, but the published package has a notably weak release track record.

Repo toolingcaution

The repository uses Composer build tooling, but no security scanning tools were detected. This is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.