@ai-sdk/xai

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @ai-sdk/xai, so the package-to-repository relationship is less transparent than expected, although a monorepo can legitimately host subpackages.

Workflow auditcaution

All 13 workflows were analyzed and all action references are pinned, but one workflow combines workflow_run with an untrusted checkout, and two workflows have top-level write permissions; high-confidence blanket GitHub App permissions and template-injection findings add workflow hygiene risk. The cache-poisoning findings are low confidence and do not independently carry much weight.