agenthub-git
LOW
maintainer albaloola
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The npx commands execute trusted dev tooling (@electron/rebuild, electron-builder) from the project's own dependencies, not arbitrary remote code, and are part of standard Electron build workflows.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx commands execute trusted dev tooling (@electron/rebuild, electron-builder) from the project's own dependencies, not arbitrary remote code, and are part of standard Electron build workflows.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:86
npx --yes @electron/rebuild -w better-sqlite3 || true -
PKGBUILD:92
npx --yes electron-builder --linux --dir
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Omer Elbushra <omaralbushra99@gmail.com>
2
3
pkgname=agenthub-git
4
_pkgname=agenthub
5
pkgver=0.1.0.r0.g0000000
6
pkgrel=1
7
pkgdesc='Multi-agent conversation hub with an Electron desktop shell and bundled Next.js backend'
8
arch=('x86_64')
9
url='https://github.com/Albaloola/AgentHub'
10
license=('Apache-2.0')
11
depends=(
12
'alsa-lib'
13
'at-spi2-core'
14
'cairo'
15
'gtk3'
16
'libdrm'
17
'libxkbcommon'
18
'libnotify'
19
'libsecret'
20
'mesa'
21
'nspr'
22
'nss'
23
'pango'
24
'hicolor-icon-theme'
25
'xdg-utils'
26
)
27
makedepends=(
28
'git'
29
'nodejs>=20'
30
'npm'
31
)
32
provides=("${_pkgname}=${pkgver}")
33
conflicts=("${_pkgname}" "${_pkgname}-bin")
34
options=('!strip' '!debug')
35
source=(
36
"${_pkgname}::git+${url}.git"
37
'agenthub.sh'
38
'agenthub.desktop'
39
)
40
sha256sums=(
41
'SKIP'
42
'SKIP'
43
'SKIP'
44
)
45
46
pkgver() {
47
cd "${srcdir}/${_pkgname}"
48
# Prefer the package.json version, suffixed with git rev count + short hash.
49
local base
50
base="$(node -p "require('./package.json').version" 2>/dev/null || echo 0.0.0)"
51
printf '%s.r%s.g%s' \
52
"${base}" \
53
"$(git rev-list --count HEAD)" \
54
"$(git rev-parse --short HEAD)"
55
}
56
57
prepare() {
58
cd "${srcdir}/${_pkgname}"
59
# Avoid every optional downstream postinstall that fetches headless
60
# browsers, native binaries we don't need at build time, or analytics.
61
export CYPRESS_INSTALL_BINARY=0
62
export PUPPETEER_SKIP_DOWNLOAD=1
63
export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
64
export ADBLOCK=1
65
export npm_config_fund=false
66
export npm_config_audit=false
67
}
68
69
build() {
70
cd "${srcdir}/${_pkgname}"
71
72
export CYPRESS_INSTALL_BINARY=0
73
export PUPPETEER_SKIP_DOWNLOAD=1
74
export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
75
export ELECTRON_SKIP_BINARY_DOWNLOAD=0
76
export npm_config_fund=false
77
export npm_config_audit=false
78
79
# The repository ships package-lock.json; use npm ci for reproducibility
80
# but fall back to install if lockfile and manifest have drifted.
81
npm ci --no-audit --no-fund --ignore-scripts || \
82
npm install --no-audit --no-fund --ignore-scripts
83
84
# postinstall is skipped above (--ignore-scripts) so run the electron-rebuild
85
# step explicitly to produce better-sqlite3 against Electron's ABI.
86
npx --yes @electron/rebuild -w better-sqlite3 || true
87
88
npm run desktop:build
89
90
# Pack into a Linux unpacked directory (no AppImage — we install the
91
# unpacked tree directly into /opt/agenthub).
92
npx --yes electron-builder --linux --dir
93
}
94
95
package() {
96
cd "${srcdir}/${_pkgname}"
97
98
# Install Electron runtime + packaged app resources into /opt/agenthub
99
install -dm755 "${pkgdir}/opt/${_pkgname}"
100
cp -a release/linux-unpacked/. "${pkgdir}/opt/${_pkgname}/"
101
102
# Launcher wrapper in $PATH
103
install -Dm755 "${srcdir}/agenthub.sh" "${pkgdir}/usr/bin/${_pkgname}"
104
105
# Desktop entry
106
install -Dm644 "${srcdir}/agenthub.desktop" \
107
"${pkgdir}/usr/share/applications/${_pkgname}.desktop"
108
109
# Scalable icon (uses the app's own globe.svg — replace with a custom
110
# PNG/ICO when the project ships proper branding assets).
111
install -Dm644 public/globe.svg \
112
"${pkgdir}/usr/share/icons/hicolor/scalable/apps/${_pkgname}.svg"
113
114
# License: reproduce Apache 2.0 pointer inline. Upstream ships the
115
# license text only in README.md at the moment; update once a LICENSE
116
# file lands in the repo.
117
install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
118
cat > "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" <<'EOF'
119
AgentHub is distributed under the Apache License, Version 2.0.
120
The full text is available at https://www.apache.org/licenses/LICENSE-2.0
121
and is referenced in the upstream README.md.
122
EOF
123
124
# Electron's chrome-sandbox wants setuid root on Linux to isolate
125
# renderer processes. Without this Electron refuses to start unless
126
# --no-sandbox is passed. pacman preserves mode bits from the staging
127
# directory, so set them here.
128
if [[ -f "${pkgdir}/opt/${_pkgname}/chrome-sandbox" ]]; then
129
chmod 4755 "${pkgdir}/opt/${_pkgname}/chrome-sandbox"
130
fi
131
}
132
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |