capi-shell-mcp

LOW

maintainer cwrau 0 votes scanned 2026-09-22 19:39:10.055575

View on AUR

Why flagged

The package installs a self-contained npm release asset from the project's own GitHub repository, which is normal for Node.js packages; the flagged variable use in package manager invocation refers to a locally sourced, versioned tarball from a trusted project host, and the low votes/recent upload are metadata concerns, not security issues.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a self-contained npm release asset from the project's own GitHub repository, which is normal for Node.js packages; the flagged variable use in package manager invocation refers to a locally sourced, versioned tarball from a trusted project host, and the low votes/recent upload are metadata concerns, not security issues.

PKGBUILD:32 npm install -g --prefix "$pkgdir/usr" "$srcdir/$_ci_asset"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Chris Werner Rau <aur@cwrau.io>
    
      2
    
      3pkgname=capi-shell-mcp
    
      4pkgver=1.0.0 # renovate: datasource=github-releases depName=cwrau/capi-shell-mcp
    
      5pkgrel=1
    
      6pkgdesc="MCP provider for capi-shell — exec into cluster-api workload clusters"
    
      7url="https://github.com/cwrau/$pkgname"
    
      8arch=('any')
    
      9license=('MIT')
    
      10depends=('nodejs')
    
      11makedepends=('npm')
    
      12install="$pkgname.install"
    
      13provides=('capo-shell-mcp')
    
      14conflicts=('capo-shell-mcp')
    
      15replaces=('capo-shell-mcp')
    
      16# CI (npm pack, with the 4 runtime deps declared as bundledDependencies)
    
      17# uploads a fully self-contained release asset -- node_modules and all, so
    
      18# a plain global npm install needs no network and no separate dependency
    
      19# resolution. contrib/systemd/ and config.example.yaml aren't in that
    
      20# tarball (not runtime files), so pull those from the source archive of the
    
      21# same tag.
    
      22_ci_asset="$pkgname-$pkgver.tgz"
    
      23_srcdir="$pkgname-$pkgname-v$pkgver"
    
      24source=(
    
      25  "$_ci_asset::https://github.com/cwrau/$pkgname/releases/download/$pkgname-v$pkgver/$_ci_asset"
    
      26  "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/$pkgname-v$pkgver.tar.gz"
    
      27)
    
      28sha256sums=('86be76ac450f92450611a5b64b9614618d4fea1363d048f706d495196ede032c'
    
      29            '7a56bdcd3b2cc6390183abfa1bb46b3094097da8a2615d3b2ece1b6d901bbf7f')
    
      30
    
      31package() {
    
      32  npm install -g --prefix "$pkgdir/usr" "$srcdir/$_ci_asset"
    
      33  chmod go-w -R "$pkgdir"
    
      34
    
      35  cd "$srcdir/$_srcdir"
    
      36
    
      37  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      38  install -Dm644 config.example.yaml "$pkgdir/usr/share/doc/$pkgname/config.example.yaml"
    
      39
    
      40  install -dm755 "$pkgdir/usr/lib/systemd/user"
    
      41  install -m644 contrib/systemd/$pkgname.service contrib/systemd/$pkgname-config.path \
    
      42    contrib/systemd/$pkgname-config.service "$pkgdir/usr/lib/systemd/user/"
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-22 19:39:10	Low	2