shopsys/maker

Dependency profilecaution

The package declares 21 runtime dependencies, consistent with a Symfony and Shopsys code-generation bundle but still creating a relatively broad dependency surface.

Licensecaution

The artifact and repository contain an MIT license file, but the manifest declares the package proprietary. That mismatch creates a real licensing ambiguity despite the available license text.

Repo toolingcaution

Composer build tooling is present. No security-scanning tools were detected, leaving a modest repository hygiene gap.

Security policycaution

The repository has no security policy. This weakens transparency around vulnerability reporting, though it does not by itself indicate abandonment.

Workflow auditcaution

The single workflow was fully analyzed with no injection, untrusted-checkout, or audit findings, and it avoids top-level write permissions. Both action references are unpinned, which is a supply-chain hygiene weakness.