boostchanger-py

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 72%): The cheaper model's concern about `pip install plyer` is valid but overstated. 'plyer' is a well-known, legitimate Python library on PyPI used for cross-platform notifications; it is not an unofficial or personal package. The real issues here are packaging quality problems: (1) `pip install plyer` runs at build time without version pinning or hash verification, bypassing pacman dependency tracking — this is sloppy but not a novel supply-chain attack vector beyond what any pip usage entails; (2) `md5sums=('SKIP')` means the upstream tarball is not integrity-checked; (3) the PKGBUILD writes to `$HOME` of the build user during `package()`, which is non-standard; (4) `prepare()` incorrectly references `$pkgdir` which is not set at that stage. These are all packaging quality/correctness issues. The source is from the maintainer's own GitHub releases (matching the package URL), and the installed content is Python scripts plus a shell wrapper — no pre-compiled binaries from unofficial hosts. Overall this is low severity: sloppy packaging with no integrity checking and an unpinned pip dependency, but not a genuine supply-chain attack or execution of binaries from an unofficial host.