rlorenzo/mago-wordpress

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts. These hooks increase installation-time execution and supply-chain exposure, even though they may be functional for this extension.

Release historycaution

The package is only 3 days old, despite 6 releases and a recent release within hours of collection. That shows active early development but provides little evidence of long-term stability.

Security policycaution

The repository has no security policy. That is a transparency gap for a package whose extension worker runs inside a consumer project.

Workflow auditcaution

The single workflow was fully audited, uses read-only permissions, and pins all action references. Three high-confidence unpinned-tools findings are a reproducibility hygiene issue, not a severe dependency risk.