@openrouter/ai-sdk-provider

Repo toolingcaution

The project uses established TypeScript and bundling tools, but no security-scanning tooling was detected, leaving a modest process gap.

Security policycaution

The repository has no security policy, which reduces transparency for reporting and handling vulnerabilities.

Workflow auditcaution

All 10 action references are unpinned, and a high-severity cache-poisoning pattern was reported with low confidence; the audit found no untrusted checkout or script injection, and the adhoc-package finding is a smaller hygiene concern.