botan2-bin

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 92%): The build() function executes 'sudo "$srcdir/serializer"' - a local script included in the source array with a bare filename (no URL, just 'serializer'). This means it's a file bundled directly in the PKGBUILD repository/snapshot. Running an arbitrary script with sudo during a package build is a serious red flag: it grants root privileges to an unreviewed script outside the normal makepkg sandbox. The sha256 for 'serializer' is provided (4493316d...), so the content is pinned, but the script itself is opaque without inspection. More critically, legitimate Botan2 builds have no need for sudo or a 'serializer' script - the official botan2 package in Arch repos builds fine without either. The use of sudo in build() is explicitly against AUR guidelines and makepkg conventions, and the presence of an unexplained bundled executable run as root strongly suggests malicious intent or at minimum a severe supply-chain risk. The '-bin' suffix is also suspicious since this PKGBUILD actually compiles from source rather than installing a pre-built binary. This combination - unexplained bundled script, sudo execution, deviation from the legitimate package's build process - warrants a HIGH rating.