@vercel/detect-agent

Build provenancecaution

No build attestation is present, although the package uses a GitHub trusted publisher; this limits publication transparency without indicating abandonment.

Repo package mentioncaution

The linked Vercel repository neither matches the package name nor mentions it in its README, creating uncertainty that this repository directly documents the package; the organization-backed monorepo context partly offsets that concern.

Workflow auditcaution

All 24 workflows were analyzed, but one file failed auditing, 75 of 156 action uses are unpinned, and high-confidence template-injection findings plus adhoc package installs indicate workflow hygiene concerns. No untrusted checkouts or script-injection findings were reported.