android-agent-lab-bin

MEDIUM

maintainer hashimkarim 0 votes scanned 2026-09-05 22:01:36.851925

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release without source code availability, creating a supply-chain risk if the release artifact is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release without source code availability, creating a supply-chain risk if the release artifact is compromised.

PKGBUILD

      1# Maintainer: Hashim Karim <hashimkarim168@gmail.com>
    
      2pkgname=android-agent-lab-bin
    
      3pkgver=0.2.0
    
      4pkgrel=1
    
      5pkgdesc='Shared Android devices, scrcpy video, and visible agent cursors'
    
      6arch=('x86_64' 'aarch64')
    
      7url='https://github.com/Hashim-K/android-agent-lab'
    
      8license=('MIT')
    
      9depends=('python' 'android-tools' 'gtk3' 'nss' 'libxss' 'libxtst' 'xdg-utils'
    
      10         'at-spi2-core' 'util-linux-libs' 'libsecret' 'libglvnd' 'mesa' 'alsa-lib')
    
      11optdepends=('docker: bundled Android 16 emulator on x86_64'
    
      12            'docker-compose: bundled emulator orchestration')
    
      13provides=('android-agent-lab')
    
      14conflicts=('android-agent-lab')
    
      15options=('!strip' '!debug')
    
      16source_x86_64=("$url/releases/download/v$pkgver/Android-Agent-Lab-$pkgver-x64.pkg.tar.zst")
    
      17source_aarch64=("$url/releases/download/v$pkgver/Android-Agent-Lab-$pkgver-aarch64.pkg.tar.zst")
    
      18sha256sums_x86_64=('a9551dc2335d18071562f70c4a476b99019534f6bfdc6298c86376a32a10666e')
    
      19sha256sums_aarch64=('485c2b4c487526a272b05ff2b8dc52ed97923386c5a41b5c4bd7a3047430d22e')
    
      20noextract=("Android-Agent-Lab-$pkgver-x64.pkg.tar.zst"
    
      21           "Android-Agent-Lab-$pkgver-aarch64.pkg.tar.zst")
    
      22
    
      23package() {
    
      24  local release_arch=x64
    
      25  [[ $CARCH == aarch64 ]] && release_arch=aarch64
    
      26  bsdtar -xf "Android-Agent-Lab-$pkgver-$release_arch.pkg.tar.zst" -C "$pkgdir" opt usr
    
      27  install -d "$pkgdir/usr/lib"
    
      28  mv "$pkgdir/opt/Android Agent Lab" "$pkgdir/usr/lib/android-agent-lab"
    
      29  rmdir "$pkgdir/opt"
    
      30  install -d "$pkgdir/usr/bin"
    
      31  cat > "$pkgdir/usr/bin/android-agent-lab" <<'LAUNCHER'
    
      32#!/bin/sh
    
      33unset ELECTRON_RUN_AS_NODE
    
      34exec /usr/lib/android-agent-lab/android-agent-lab "$@"
    
      35LAUNCHER
    
      36  chmod 755 "$pkgdir/usr/bin/android-agent-lab"
    
      37  chmod 4755 "$pkgdir/usr/lib/android-agent-lab/chrome-sandbox"
    
      38  sed -i 's|^Exec=.*|Exec=android-agent-lab %U|' \
    
      39    "$pkgdir/usr/share/applications/android-agent-lab.desktop"
    
      40  install -Dm644 "$pkgdir/usr/lib/android-agent-lab/resources/runtime/LICENSE" \
    
      41    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-05 22:01:36	Medium	2