utopia-php/pools

Dangerous workflowscaution

One workflow uses pull_request_target, which requires careful review because it can execute privileged automation in pull-request contexts; no untrusted checkout or script injection was detected, limiting the concern.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. This is a transparency and defense-in-depth gap rather than a direct indication that the package is unsafe.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations unspecified. This is a genuine governance gap, but it is moderated by the strong maintenance and release activity.

Token permissionscaution

The mirror workflow has top-level write permissions. Although no missing permission declarations were found, broad write access increases workflow-impact risk and merits review.