@oclif/plugin-plugins

Lifecycle scriptscaution

The package declares postpack, prepack, and prepare lifecycle scripts. These can add install or packaging behavior that consumers should understand, though the signal alone does not show harmful activity.

Security policycaution

The repository has no security policy, which leaves vulnerability-reporting expectations less transparent; this is a moderate hygiene gap rather than evidence of abandonment.

Workflow auditcaution

All seven workflows were analyzed without untrusted checkouts or script injection, but all 18 action references are unpinned and a high-confidence medium-severity secrets-inherit finding affects onRelease.yml. The workflow_run trigger is ordinary and no workflow has top-level write permissions.