@ai-sdk/gateway

Repo package mentioncaution

The linked repository is a monorepo whose name does not match this package and whose README does not mention it, so package ownership is less transparent despite the organization backing.

Workflow auditcaution

All 13 workflows were analyzed with no failed files, all 78 action references are pinned, and 11 workflows use read-only permissions. High-confidence findings include blanket GitHub App permissions and a possible template injection; these are workflow hygiene concerns, while the untrusted checkout is in a different workflow from those findings.