tomasnorre/crawler

Lifecycle scriptscaution

A post-autoload-dump install-time script runs during Composer installation, adding some execution surface. No other lifecycle scripts or adverse evidence were provided.

Project backingcaution

The package and repository are owned by the same individual account rather than an organization. That is transparent ownership, though it provides less formal handoff capacity than organizational backing.

Repo issue activitycaution

There are 16 open issues and no issue or pull-request activity in the last month. This is a mild transparency concern, but recent commits and releases provide compensating maintenance evidence.

Workflow auditcaution

All 53 analyzed action references are unpinned, and the audit found a high-confidence template-injection issue; a low-confidence cache-poisoning finding is additional hygiene debt. No pull_request_target or workflow_run triggers, untrusted checkouts, or script injections were found, which limits the practical severity.