aimp-skin-acryl

LOW

maintainer badcast 0 votes scanned 2026-10-06 00:19:23.678998

View on AUR

Why flagged

Downloads an AIMP skin archive from aimp.ru (the official AIMP website) with a fixed sha256 checksum; the payload is pure theme/skin data that is never executed, so even if the host were compromised the worst case is cosmetic data tampering, not code execution.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): Downloads an AIMP skin archive from aimp.ru (the official AIMP website) with a fixed sha256 checksum; the payload is pure theme/skin data that is never executed, so even if the host were compromised the worst case is cosmetic data tampering, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=('aimp-skin-acryl-142.archive::https://aimp.ru/?do=catalog.download&id=142')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: badcast <lmecomposer@gmail.com>
    
      2# Generated by csv2pkgbuild.py - https://github.com/badcast/aimpskins
    
      3
    
      4pkgname='aimp-skin-acryl'
    
      5pkgdesc='AIMP skin: Acryl 1.0 (by Freyr (aka Kristall_k8))'
    
      6pkgver=20261001
    
      7pkgrel=2
    
      8arch=('any')
    
      9url='https://github.com/badcast/aimpskins'
    
      10license=('custom')
    
      11groups=('AIMP_Skins')
    
      12depends=('aimp')
    
      13makedepends=('libarchive')
    
      14options=('!strip' '!debug')
    
      15_skinsdir='/opt/aimp/Skins'
    
      16
    
      17source=('aimp-skin-acryl-142.archive::https://aimp.ru/?do=catalog.download&id=142')
    
      18noextract=("${source[@]%%::*}")
    
      19sha256sums=('1005263a95173b69d3edc66cb913fddbfba6b1f774af98a7920720a723f03a37')
    
      20
    
      21package() {
    
      22  local dest="$pkgdir$_skinsdir"
    
      23  install -dm755 "$dest"
    
      24  bsdtar -xf "$srcdir/aimp-skin-acryl-142.archive" -C "$dest"
    
      25  find "$dest" -mindepth 2 -type f -exec mv -t "$dest" {} +
    
      26  find "$dest" -mindepth 1 -type d -empty -delete
    
      27  find "$dest" -type d -exec chmod 755 {} +
    
      28  find "$dest" -type f -exec chmod 644 {} +
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:19:23	Low	3
2026-10-06 00:13:36	Low	3
2026-10-05 23:40:58	Medium	2