plugin/owc-gravityforms-zgw

Lifecycle scriptscaution

Post-install and post-update Composer scripts are present. They add execution during installation, but this signal alone does not show unsafe behavior or undermine the package's otherwise strong project evidence.

Repo bus factorcaution

All 20 recent commits came from one contributor, creating a real continuity risk. The organization-owned repository provides some compensating backing, so this is caution rather than danger.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package. Although the source tree is substantial, this weakens confidence that the linked repository is specifically the package's source.

Workflow auditcaution

All three workflows were analyzed successfully with no untrusted checkouts, script injections, or audit findings. However, all three action references are unpinned, and one workflow grants top-level write permissions, creating moderate workflow hygiene concerns.