@vercel/detect-agent

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention it, creating uncertainty about package-specific ownership; the Vercel organization and monorepo context partly compensate.

Workflow auditcaution

All 24 workflows were analyzed, but one file failed auditing, 75 of 156 action references are unpinned, and high-confidence template-injection findings plus adhoc package installs remain. The reported trusted-publishing item is informational, so the main effect is workflow hygiene caution rather than a severe dependency verdict.