php-concept/skeleton-2

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts run during Composer operations, adding execution during installation and updates. No provided signal shows that this behavior is unnecessary or independently verified, so it is a supply-chain hygiene concern.

Release historycaution

The package is only 2 days old, despite six releases in that period and a median interval of about 2 hours 30 minutes. This shows active initial work but not yet established maintenance or release stability.

Security policycaution

The repository has no security policy, leaving no documented channel or process for reporting vulnerabilities. This is a transparency gap, though it is not by itself evidence of unsafe code.

Workflow auditcaution

The single workflow was fully analyzed with no high-confidence audit findings and no untrusted triggers or sinks. However, both of its two action references are unpinned, so they can change without a reviewed repository commit.