whilesmart/laravel-plugin-engine

Licensecaution

The manifest declares the package proprietary while the artifact and repository contain an MIT license file. That conflict creates a real licensing clarification risk despite the available license text.

Repo popularitycaution

One star and no forks or watchers indicate a very small adoption footprint. Popularity is only supporting evidence, but this limits external validation.

Repo toolingcaution

The project uses Composer and Make for builds, but no security-scanning tools were detected. Build tooling is present, while automated security coverage is not evident.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

All five analyzed action references are unpinned, and two workflows grant top-level write permissions. No dangerous triggers, untrusted checkouts, or audit findings were detected, so this is workflow hygiene rather than a severe risk.