agent-cli-detector

Repo toolingcaution

The project uses TypeScript, tsup, and npm scripts for builds, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, reducing transparency for vulnerability reporting and response expectations.

Version stabilitycaution

Version 0.1.7 is not a stable major release, so its API may still change, but it is not marked as a prerelease and recent prerelease share is zero.

Workflow auditcaution

Both workflows were fully analyzed with no untrusted checkout or script-injection paths, but all four action references are unpinned and the publish workflow has high-confidence adhoc package installation plus top-level write permissions; the cache-poisoning finding is low confidence and therefore only hygiene.