azros-agent

MEDIUM

maintainer Connor 0 votes scanned 2026-10-06 00:19:23.678998

View on AUR

Why flagged

A prebuilt x86_64 AppImage binary is downloaded from a personal/project-owned but non-official, non-auditable host (repo.agentics.co.za) and installed as an executable; while the checksum is present, the source is a single-vendor private repo with no independent verification, making it a swappable prebuilt binary from an unverifiable host.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("azros-agent-0.1.47-x86_64.AppImage::https://repo.agentics.co.za/x86_64/azros-agent-0.1.47-x86_64.AppImage")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 80%): A prebuilt x86_64 AppImage binary is downloaded from a personal/project-owned but non-official, non-auditable host (repo.agentics.co.za) and installed as an executable; while the checksum is present, the source is a single-vendor private repo with no independent verification, making it a swappable prebuilt binary from an unverifiable host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Connor Etherington <connor@agentics.co.za>
    
      2# ---
    
      3pkgname=azros-agent
    
      4pkgver=0.1.47
    
      5pkgrel=1
    
      6pkgdesc="Azros Agent - the Azros coding agent on its own, building into your AzrOS Workspace"
    
      7arch=('x86_64')
    
      8url="https://agentics.co.za"
    
      9license=('custom')
    
      10depends=()
    
      11options=('!strip' '!debug')
    
      12source=("azros-agent-0.1.47-x86_64.AppImage::https://repo.agentics.co.za/x86_64/azros-agent-0.1.47-x86_64.AppImage")
    
      13sha512sums=('2fa8a48ddec22f24a451cc0210c4f5dbd400a4a50a50bcd3c4fc4cdf58fc318ca87b455ac4d31cb4d83dc9d0950d413f28d69587de89219efdfc4607364615e5')
    
      14
    
      15package() {
    
      16  install -Dm755 "$srcdir/azros-agent-0.1.47-x86_64.AppImage" "$pkgdir/opt/agentics/azros-agent.AppImage"
    
      17  install -dm755 "$pkgdir/usr/bin"
    
      18  printf '%s\n' '#!/bin/sh' 'exec /opt/agentics/azros-agent.AppImage "$@"' > "$pkgdir/usr/bin/azros-agent"
    
      19  chmod 755 "$pkgdir/usr/bin/azros-agent"
    
      20  install -dm755 "$pkgdir/usr/share/applications"
    
      21  printf '%s\n' \
    
      22    '[Desktop Entry]' 'Type=Application' 'Name=Azros Agent' \
    
      23    'Comment=the Azros coding agent on its own, building into your AzrOS Workspace' 'Exec=/usr/bin/azros-agent %U' \
    
      24    'Icon=agentics' 'Categories=Utility;Development;' 'Terminal=false' \
    
      25    > "$pkgdir/usr/share/applications/azros-agent.desktop"
    
      26}
    
      27

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:19:23	Medium	3
2026-10-06 00:13:36	Medium	3
2026-10-05 23:40:58	Medium	3