@oclif/plugin-help

Lifecycle scriptscaution

The package uses postpack, prepack, and prepare lifecycle scripts, which add build-time execution during installation or publication. The signal does not show harmful behavior, so this is a limited supply-chain hygiene concern.

Security policycaution

No repository security policy was found. This is a transparency gap, though it is outweighed by the active repository and available Dependabot scanning.

Workflow auditcaution

All seven workflows were analyzed with no untrusted checkout or script-injection findings and no top-level write permissions. However, all 11 action references are unpinned, and a high-confidence medium-severity secrets-inherit finding shares credentials with a reusable workflow, creating actionable automation hygiene risk.