sandermuller/boost-skills

Lifecycle scriptscaution

Composer post-install and post-update scripts run automatically, which increases review requirements because installation can execute package-controlled actions. This is a genuine supply-chain hygiene concern even though the package is primarily Markdown.

Token permissionscaution

One workflow has no top-level permissions declaration, which is less explicit than ideal; however, no workflow declares top-level write permissions and another uses read-only permissions, limiting the concern.