vivutio/skeleton

Workflow auditdanger

The audit covered both workflows and found a high-confidence template-injection issue in release.yml; all six action references are unpinned, and one workflow grants top-level write access. No untrusted checkout or script-injection trigger was found to compound the issue.

Lifecycle scriptscaution

Composer runs post-install and post-update scripts, which is common for Symfony packages but adds install-time behavior that consumers should understand.

Release historycaution

Six releases in two days show active development, but a package age of only two days provides almost no evidence of long-term maintenance or release discipline.

Repo bus factorcaution

One contributor made all six recent commits, creating a low bus factor. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

Six commits in the last three months, all concentrated in one active maintainer, show recent work but limited evidence of sustained maintenance capacity.