o3-shop/shop-ce

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts execute during dependency operations, adding review and reproducibility considerations for consumers.

Repo popularitycaution

The repository has 6 stars and 8 forks, modest supporting adoption evidence; this does not outweigh the stronger direct maintenance signals.

Security policycaution

No repository security policy was found, reducing transparency for reporting vulnerabilities even though CodeQL and Dependabot are present.

Version stabilitycaution

This release is a prerelease and 75% of recent releases are prereleases, so consumers may face more change than with a stable release.

Workflow auditcaution

All four workflows were analyzed, but all 22 action references are unpinned, and high-confidence template-injection findings plus an unpinned container image were reported. The script-injection finding is in code-quality.yml without an untrusted checkout or pull_request_target trigger, so it warrants workflow caution rather than a standalone severe rating.