Package Health/vonaffenfels/wp-plugin-skeleton

vonaffenfels/wp-plugin-skeleton

The package includes a README, tests, a changelog, and a matching organization-owned repository. However, it has had no release or commit activity in the past year, and all 11 workflow actions are unpinned.

Latest 1.0.0

Packagist

57%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 10 releases over roughly three years, but none in the last 12 months; the latest release was over a year ago. This indicates materially slowed maintenance, despite a nontrivial release history.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the absence of recent registry releases. This raises abandonment risk even though the repository is not archived.

Repo tooling

Composer build tooling is present, but no security scanning tools are reported. The missing scanning is a modest transparency and maintenance gap rather than a standalone severe risk.

Security policy

The repository has no security policy. This weakens vulnerability-reporting transparency, although it does not establish that the package is unsafe.

Workflow audit

Both workflows were analyzed completely with no dangerous triggers, untrusted checkouts, script injections, or audit findings. However, all 11 action references are unpinned, leaving avoidable build reproducibility and action-substitution risk.