@oclif/plugin-autocomplete

Lifecycle scriptscaution

The package declares postpack, prepack, and prepare scripts, so installation and publication involve lifecycle execution; this is a modest supply-chain hygiene consideration, not evidence of unsafe behavior by itself.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response guidance less transparent for users and contributors.

Workflow auditcaution

All 11 analyzed action references are unpinned, and the audit found a high-confidence medium-severity secrets-inherit issue in onRelease.yml. No untrusted checkout, script injection, or broad top-level write permission was detected, which limits the risk.