@oclif/core

Lifecycle scriptscaution

The package uses prepack and prepare lifecycle scripts. These are relevant build-time behavior to review, but the signal alone does not show unsafe installation activity.

Security policycaution

No repository security policy was found, leaving disclosure guidance less explicit, but active maintenance and Dependabot partly compensate for this transparency gap.

Workflow auditcaution

All 8 workflows were analyzed with no failed files and no untrusted checkout or script-injection findings. However, all 26 action references are unpinned, and high-confidence template-injection findings plus secrets inheritance create workflow hygiene and exposure concerns; no dangerous trigger-and-sink combination is shown.