@ai-sdk/google

Repo package mentioncaution

The repository name does not match the package and its README does not mention @ai-sdk/google, which creates some ambiguity about package ownership despite the visible package source tree and organization backing.

Workflow auditcaution

All 13 workflows were analyzed with no unpinned actions, but one workflow combines an untrusted checkout with a workflow_run trigger, and high-confidence findings report blanket GitHub App permissions and template-injection risk. Most cache findings are low confidence and remain hygiene concerns.