agenthub-git

maintainer albaloola · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx commands execute trusted dev tooling (@electron/rebuild, electron-builder) from the project's own dependencies, not arbitrary remote code, and are part of standard Electron build workflows.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx commands execute trusted dev tooling (@electron/rebuild, electron-builder) from the project's own dependencies, not arbitrary remote code, and are part of standard Electron build workflows.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:86 npx --yes @electron/rebuild -w better-sqlite3 || true
PKGBUILD:92 npx --yes electron-builder --linux --dir

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Omer Elbushra <omaralbushra99@gmail.com>
    
      2
    
      3pkgname=agenthub-git
    
      4_pkgname=agenthub
    
      5pkgver=0.1.0.r0.g0000000
    
      6pkgrel=1
    
      7pkgdesc='Multi-agent conversation hub with an Electron desktop shell and bundled Next.js backend'
    
      8arch=('x86_64')
    
      9url='https://github.com/Albaloola/AgentHub'
    
      10license=('Apache-2.0')
    
      11depends=(
    
      12  'alsa-lib'
    
      13  'at-spi2-core'
    
      14  'cairo'
    
      15  'gtk3'
    
      16  'libdrm'
    
      17  'libxkbcommon'
    
      18  'libnotify'
    
      19  'libsecret'
    
      20  'mesa'
    
      21  'nspr'
    
      22  'nss'
    
      23  'pango'
    
      24  'hicolor-icon-theme'
    
      25  'xdg-utils'
    
      26)
    
      27makedepends=(
    
      28  'git'
    
      29  'nodejs>=20'
    
      30  'npm'
    
      31)
    
      32provides=("${_pkgname}=${pkgver}")
    
      33conflicts=("${_pkgname}" "${_pkgname}-bin")
    
      34options=('!strip' '!debug')
    
      35source=(
    
      36  "${_pkgname}::git+${url}.git"
    
      37  'agenthub.sh'
    
      38  'agenthub.desktop'
    
      39)
    
      40sha256sums=(
    
      41  'SKIP'
    
      42  'SKIP'
    
      43  'SKIP'
    
      44)
    
      45
    
      46pkgver() {
    
      47  cd "${srcdir}/${_pkgname}"
    
      48  # Prefer the package.json version, suffixed with git rev count + short hash.
    
      49  local base
    
      50  base="$(node -p "require('./package.json').version" 2>/dev/null || echo 0.0.0)"
    
      51  printf '%s.r%s.g%s' \
    
      52    "${base}" \
    
      53    "$(git rev-list --count HEAD)" \
    
      54    "$(git rev-parse --short HEAD)"
    
      55}
    
      56
    
      57prepare() {
    
      58  cd "${srcdir}/${_pkgname}"
    
      59  # Avoid every optional downstream postinstall that fetches headless
    
      60  # browsers, native binaries we don't need at build time, or analytics.
    
      61  export CYPRESS_INSTALL_BINARY=0
    
      62  export PUPPETEER_SKIP_DOWNLOAD=1
    
      63  export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
    
      64  export ADBLOCK=1
    
      65  export npm_config_fund=false
    
      66  export npm_config_audit=false
    
      67}
    
      68
    
      69build() {
    
      70  cd "${srcdir}/${_pkgname}"
    
      71
    
      72  export CYPRESS_INSTALL_BINARY=0
    
      73  export PUPPETEER_SKIP_DOWNLOAD=1
    
      74  export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
    
      75  export ELECTRON_SKIP_BINARY_DOWNLOAD=0
    
      76  export npm_config_fund=false
    
      77  export npm_config_audit=false
    
      78
    
      79  # The repository ships package-lock.json; use npm ci for reproducibility
    
      80  # but fall back to install if lockfile and manifest have drifted.
    
      81  npm ci --no-audit --no-fund --ignore-scripts || \
    
      82    npm install --no-audit --no-fund --ignore-scripts
    
      83
    
      84  # postinstall is skipped above (--ignore-scripts) so run the electron-rebuild
    
      85  # step explicitly to produce better-sqlite3 against Electron's ABI.
    
      86  npx --yes @electron/rebuild -w better-sqlite3 || true
    
      87
    
      88  npm run desktop:build
    
      89
    
      90  # Pack into a Linux unpacked directory (no AppImage — we install the
    
      91  # unpacked tree directly into /opt/agenthub).
    
      92  npx --yes electron-builder --linux --dir
    
      93}
    
      94
    
      95package() {
    
      96  cd "${srcdir}/${_pkgname}"
    
      97
    
      98  # Install Electron runtime + packaged app resources into /opt/agenthub
    
      99  install -dm755 "${pkgdir}/opt/${_pkgname}"
    
      100  cp -a release/linux-unpacked/. "${pkgdir}/opt/${_pkgname}/"
    
      101
    
      102  # Launcher wrapper in $PATH
    
      103  install -Dm755 "${srcdir}/agenthub.sh" "${pkgdir}/usr/bin/${_pkgname}"
    
      104
    
      105  # Desktop entry
    
      106  install -Dm644 "${srcdir}/agenthub.desktop" \
    
      107    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      108
    
      109  # Scalable icon (uses the app's own globe.svg — replace with a custom
    
      110  # PNG/ICO when the project ships proper branding assets).
    
      111  install -Dm644 public/globe.svg \
    
      112    "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${_pkgname}.svg"
    
      113
    
      114  # License: reproduce Apache 2.0 pointer inline. Upstream ships the
    
      115  # license text only in README.md at the moment; update once a LICENSE
    
      116  # file lands in the repo.
    
      117  install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      118  cat > "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" <<'EOF'
    
      119AgentHub is distributed under the Apache License, Version 2.0.
    
      120The full text is available at https://www.apache.org/licenses/LICENSE-2.0
    
      121and is referenced in the upstream README.md.
    
      122EOF
    
      123
    
      124  # Electron's chrome-sandbox wants setuid root on Linux to isolate
    
      125  # renderer processes. Without this Electron refuses to start unless
    
      126  # --no-sandbox is passed. pacman preserves mode bits from the staging
    
      127  # directory, so set them here.
    
      128  if [[ -f "${pkgdir}/opt/${_pkgname}/chrome-sandbox" ]]; then
    
      129    chmod 4755 "${pkgdir}/opt/${_pkgname}/chrome-sandbox"
    
      130  fi
    
      131}
    
      132

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2