capy-ai-bin

LOW

maintainer kellyiscute 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Downloads a prebuilt AppImage from downloads.capy.ai, which is the project's own official download domain matching the declared url; checksums are provided and non-SKIP; the packaging is standard for a proprietary Electron/AppImage binary, so the main concern is trusting the vendor's own infrastructure, not a swappable third-party host.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a prebuilt AppImage from downloads.capy.ai, which is the project's own official download domain matching the declared url; checksums are provided and non-SKIP; the packaging is standard for a proprietary Electron/AppImage binary, so the main concern is trusting the vendor's own infrastructure, not a swappable third-party host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:50 source_x86_64=("$_pkgname-$pkgver-x86_64.AppImage::https://downloads.capy.ai/stable/capy-$pkgver-x86_64.AppImage")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kelly Guo <guojiyou40020@hotmail.com>
    
      2
    
      3pkgname=capy-ai-bin
    
      4_pkgname=capy-ai
    
      5pkgver=0.4.6
    
      6pkgrel=1
    
      7pkgdesc="Capy runs your coding agents in the cloud"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://capy.ai"
    
      10license=('LicenseRef-Proprietary')
    
      11depends=(
    
      12  'alsa-lib'
    
      13  'at-spi2-core'
    
      14  'cairo'
    
      15  'dbus'
    
      16  'expat'
    
      17  'glib2'
    
      18  'glibc'
    
      19  'gtk3'
    
      20  'hicolor-icon-theme'
    
      21  'libcups'
    
      22  'libgcc'
    
      23  'libnotify'
    
      24  'libstdc++'
    
      25  'libx11'
    
      26  'libxcb'
    
      27  'libxcomposite'
    
      28  'libxdamage'
    
      29  'libxext'
    
      30  'libxfixes'
    
      31  'libxkbcommon'
    
      32  'libxrandr'
    
      33  'libxss'
    
      34  'libxtst'
    
      35  'mesa'
    
      36  'nspr'
    
      37  'nss'
    
      38  'pango'
    
      39  'systemd-libs'
    
      40  'xdg-utils'
    
      41)
    
      42optdepends=(
    
      43  'libsecret: store credentials in the system keyring'
    
      44  'libappindicator-gtk3: tray icon on some desktops'
    
      45)
    
      46provides=("$_pkgname")
    
      47conflicts=("$_pkgname")
    
      48options=('!strip' '!debug')
    
      49source=("$_pkgname.desktop")
    
      50source_x86_64=("$_pkgname-$pkgver-x86_64.AppImage::https://downloads.capy.ai/stable/capy-$pkgver-x86_64.AppImage")
    
      51source_aarch64=("$_pkgname-$pkgver-aarch64.AppImage::https://downloads.capy.ai/stable/capy-$pkgver-arm64.AppImage")
    
      52sha256sums=('db798f3d048bea2cee12a5e3b4adfcecd2bdc69c64e952aa7ccb08d294ae304e')
    
      53sha256sums_x86_64=('7e8646ba869682cc1ed086274730bec579e405d681548553cfe0831577bd3c8e')
    
      54sha256sums_aarch64=('b76b6ac1538317af1b6063d93c94e43c482998696677bdac0e239c69690b94d0')
    
      55
    
      56prepare() {
    
      57  rm -rf squashfs-root
    
      58  chmod +x "$_pkgname-$pkgver-$CARCH.AppImage"
    
      59  "./$_pkgname-$pkgver-$CARCH.AppImage" --appimage-extract >/dev/null
    
      60}
    
      61
    
      62package() {
    
      63  cd squashfs-root
    
      64
    
      65  # Drop AppImage-only files and the bundled libs that AppRun would add to
    
      66  # LD_LIBRARY_PATH; the system versions come in through depends.
    
      67  rm -rf AppRun .DirIcon capy.desktop capy.png usr/lib
    
      68
    
      69  # Install the hicolor icons under our own name, then drop usr/ from the app dir
    
      70  local _icon
    
      71  for _icon in usr/share/icons/hicolor/*/apps/capy.png; do
    
      72    install -Dm644 "$_icon" "$pkgdir/${_icon%capy.png}$_pkgname.png"
    
      73  done
    
      74  rm -rf usr
    
      75
    
      76  install -d "$pkgdir/opt/$_pkgname"
    
      77  cp -a . "$pkgdir/opt/$_pkgname/"
    
      78  find "$pkgdir/opt/$_pkgname" -type d -exec chmod 755 {} +
    
      79  chmod -R go-w "$pkgdir/opt/$_pkgname"
    
      80  chmod 4755 "$pkgdir/opt/$_pkgname/chrome-sandbox"
    
      81
    
      82  install -d "$pkgdir/usr/bin"
    
      83  ln -s "/opt/$_pkgname/capy" "$pkgdir/usr/bin/$_pkgname"
    
      84
    
      85  install -Dm644 "$srcdir/$_pkgname.desktop" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      86
    
      87  install -d "$pkgdir/usr/share/licenses/$pkgname"
    
      88  ln -s "/opt/$_pkgname/LICENSE.electron.txt" "$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron.txt"
    
      89  ln -s "/opt/$_pkgname/LICENSES.chromium.html" "$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
    
      90}
    
      91

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 15:23:11	Low	3
2026-10-14 15:20:15	Medium	3