The image is for running security-checker, security-checker is installed in /app/ in case you need to customize the install before usage.
php-security-checker:
  stage: linting
  image: registry.gitlab.com/pipeline-components/php-security-checker:latest
  script:
    - cd ${COMPOSER_LOCATION:-.} && security-checker security:check composer.lock