@ai-sdk/anthropic

Repo package mentioncaution

The linked repository does not match the package name and does not mention the package in its README. This is compatible with a monorepo, but the missing explicit package reference weakens repository-to-package transparency.

Workflow auditcaution

All 13 workflows were analyzed and action references are fully pinned, but one workflow combines an untrusted checkout with a workflow_run trigger, and two workflows have top-level write permissions. High-confidence blanket GitHub App permissions and template-injection findings add workflow hygiene risk; the cache findings are low confidence and do not materially change the assessment.