@ai-sdk/openai

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which creates some uncertainty about package-to-repository linkage. The organization-owned monorepo context partly explains the name mismatch but does not resolve the missing README mention.

Workflow auditcaution

All 13 workflows were analyzed and all action references are pinned, but one workflow combines workflow_run with an untrusted checkout, two workflows grant broad app-token permissions, and a high-confidence template-injection finding is present. The many low-confidence cache findings are hygiene concerns rather than decisive evidence.