@assistant-ui/tap

Repo package mentioncaution

The repository name does not match the package and its README does not mention @assistant-ui/tap, which creates some uncertainty about package-to-repository linkage. The organization-owned monorepo context partly compensates for this concern.

Workflow auditcaution

All 26 workflows were analyzed with no untrusted checkouts, script injection, high- or medium-severity findings, and all 95 action references pinned. The high-confidence use-trusted-publishing finding is a caution because registry publishing uses a long-lived token rather than short-lived credentials, while the top-level write permissions are limited to four workflows and most workflows use read-only permissions.