4
As my limited understanding of how auto logins work, you have two ways of doing it;
1) Using a hugely extended custom session (which is supported by XOOPS without hacks), and is generally pretty secure (I think, not sure though)). The trade off is that it can put huge loads on your server in maintaining these sessions, especially for high traffic sites.
2) Using a cookie. This removes the need for custom sessions, but is considered a security risk as your username and password are physically stored (even though it is encrypted as an MD5 hash to my understanding) on the computer. This means there is no way of garanteeing that you, and only you get use of this cookie.
I've used GIJOE's hack for quite a while now with no issues. Also if you want verification on the above, then GIJOE is the man to ask as he is the XOOPS security guru.