@ai-sdk/provider

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, creating some uncertainty about package-to-repository linkage; the monorepo context makes a name mismatch ordinary, but the missing README mention remains a transparency gap.

Workflow auditcaution

All 13 workflows were analyzed with no failed files and all action references pinned, but one workflow combines workflow_run with an untrusted checkout, two workflows grant top-level write access, and high-confidence github-app and template-injection findings add automation hygiene risk. The numerous cache-poisoning findings are low confidence and are treated as hygiene rather than decisive evidence.