silverassist/wp-coding-standards

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts run during Composer operations, increasing installation-time behavior and review burden compared with a passive configuration package.

Repo bus factorcaution

All nine recent commits came from one contributor. Organization ownership provides some handoff capacity, but the observed maintenance base remains concentrated.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected, leaving a repository security-process gap.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

All three workflows were analyzed successfully, but the release workflow has high-confidence template-injection findings, secrets-inherit usage, top-level write permissions, and four of nine unpinned actions. The trigger and sink counts are zero, so this is workflow hygiene and credential exposure risk rather than a standalone severe verdict.