@assistant-ui/store

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, creating a package-ownership transparency gap. The organization-backed monorepo structure and package tree partially explain the mismatch but do not remove the caution.

Workflow auditcaution

All 26 workflows were analyzed with no failed files, all 95 action references are pinned, and most workflows use read-only permissions. The audit identifies high-confidence trusted publishing, which warrants a limited caution, while the pull request triggers have no untrusted checkout or script-injection sink.