wpstarter/o-workbench

Lifecycle scriptscaution

A post-autoload-dump script runs during installation. This is worth awareness because install-time behavior expands the execution surface, although the signal alone does not show harmful behavior.

Release historycaution

This is a brand-new package with one release and no established release cadence, so its maintenance history is not yet demonstrated.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. Because the package is only newly released, this may reflect its age, but it leaves maintenance capacity unproven.

Security policycaution

No security policy was found in the repository, leaving disclosure and response expectations unclear for consumers.

Workflow auditcaution

All six workflows were analyzed with no high-confidence audit findings, and four use read-only permissions. However, all 23 analyzed action references are unpinned and one workflow grants top-level write access, creating a meaningful reproducibility and token-scope hygiene concern.