particle-academy/fancy-starter-kit

Lifecycle scriptscaution

Four lifecycle scripts run during Composer installation or updates, which is expected for a project scaffold but increases install-time behavior that consumers should understand.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, while issue and pull-request totals are unknown; this gives limited evidence about community support.

Repo popularitycaution

The repository has only 2 stars and no forks or watchers, offering little external validation, but popularity is supporting evidence and the strong activity signals compensate.

Repo toolingcaution

The repository uses Composer build tooling but reports no security-scanning tools, leaving a modest transparency and maintenance-hygiene gap.

Workflow auditcaution

Both workflows were fully analyzed with no audit findings or untrusted checkout/script-injection sinks. However, all 3 action references are unpinned and one workflow grants top-level write permissions, creating workflow hygiene and least-privilege concerns.