ai-sdk — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ai-sdk (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Identify ai and the provider/React package versions in the relevant workspace's manifest, lockfile or installed package. Keep the installed major unless an upgrade is requested.
ai-sdk-7.ai-sdk-6.npm view ai dist-tagsconfirms). ai@7 pairs with @ai-sdk/react@4, ai@6 with @ai-sdk/react@3. Provider majors differ per package, so install each provider's latest for v7 and its ai-v6 dist-tag for v6 (npm view <pkg> dist-tags).
Search the resolved package's docs/, types and src/ (when shipped) first; they work without network. ai bundles docs from 6.0.32 and in 7.x; 6.0.0-6.0.31 have no docs. The docs tree mirrors the website: ai-sdk.dev/docs/<section>/<page> is ai/docs/<nn>-<section>/<nn>-<page>.mdx, so an ai-sdk.dev/docs link in these skills can be read from the installed major's copy. Provider packages ship docs/<nn>-<provider>.mdx. @ai-sdk/react, @ai-sdk/workflow, @ai-sdk/harness, @ai-sdk/otel and @ai-sdk/mcp ship no docs; their guides are in ai/docs and their API in dist/*.d.ts. Monorepo hoisting and Yarn PnP may change the paths; do not install or upgrade a dependency solely to obtain docs.
When local documentation is unavailable, use the matching repository tag (vercel/ai, tag ai@<version>, content/docs/) or docs version. The documentation search and Markdown page variants help locate the relevant feature. Repository main and the default website can target a newer major than the app. With neither local docs nor network, say which API facts remain unverified. Append &tag=v6 (v5, v6 or v7) to scope search results to a major.
Choose model IDs from the app's provider configuration or current provider catalog. The Gateway catalog can aid discovery; its IDs and capability availability do not imply that another provider accepts them. Choose capability, latency and cost for the task.
Use defaults when they fit. Typecheck changed integrations and exercise their streaming/tool path; a supported symbol can still be used with the wrong callback scope, result semantics or provider.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.