aksusbd-bin

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it HIGH (confidence 85%): This PKGBUILD has multiple serious concerns beyond the pip install of selenium. The primary issue is that the actual software being installed (aksusbd binaries) is not fetched from a declared source with a checksum — instead, a Python script (download.py) is executed during prepare() to dynamically download the package at build time using a Selenium-automated browser session. This means: (1) the actual installed binaries have no integrity verification whatsoever, (2) the download.py script (whose sha256 is listed but whose contents are opaque) controls what binary gets fetched and installed, (3) the binary is a proprietary daemon (aksusbd/hasplmd) extracted from an RPM and installed with 755 permissions — executed code from an unverified, dynamically-fetched source. The pattern of using a headless browser to scrape/download a binary at build time completely bypasses AUR's source integrity model. Even if download.py is benign today, this is a genuine supply-chain risk: the script could fetch any binary from any location, and there is no way to audit what will actually be installed. The pip install of selenium is a secondary concern. The combination of an opaque downloader script + unverified executed binaries warrants a high severity rating.