testo/inline

Dangerous workflowscaution

One analyzed workflow uses pull_request_target, a privileged workflow trigger. No untrusted checkout or script injection was detected, which reduces but does not remove the workflow risk.

Dependency profilecaution

The plugin declares five runtime dependencies, including the PHP runtime and several related testo packages; this is a meaningful dependency surface, though it is coherent with a plugin in the testo ecosystem.

Maintainerscaution

Only one registry account has publish access, which is a limited publishing bus factor. This concern is partly offset by the linked repository being owned by the php-testo organization.

Repo commit activitycaution

The repository shows zero commits and zero active maintainers in the last 3 months. The mirror explanation and recent release activity partly compensate, but maintenance cannot be independently verified from this repository.

Repo issue activitycaution

There were no new issues or pull requests in the last month and no merged pull requests; this is a weak activity signal, although the README identifies the repository as a synchronized read-only mirror.