marrow/ai-context

Release historycaution

This is the first release, published today, so there is no track record of sustained maintenance or release follow-through. Its newness limits confidence but does not by itself indicate abandonment.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. That is a modest transparency and hygiene gap for a new package.

Security policycaution

The repository has no security policy. This does not show a security defect, but it leaves vulnerability-reporting expectations unclear.

Workflow auditcaution

The sole workflow was fully analyzed and has no untrusted checkout, injection, or high-severity findings, but both of its two action references are unpinned. The missing top-level permissions block is acceptable on its own, while unpinned actions create a modest supply-chain hygiene concern.