catpaw-cn

MEDIUM
maintainer lzsnyy 0 votes scanned 2026-11-03 00:08:24.557905
View on AUR
Why flagged

Two prebuilt binaries (catpaw-cli-linux-x64 and agent-browser-linux-x64) are downloaded from non-official/personal-style hosts (s3plus.meituan.net and vercel-labs GitHub) and executed at runtime; while checksums are provided and the Meituan host is plausibly the vendor's own CDN, these are unverifiable prebuilt executables from hosts outside the project's primary official infrastructure, representing a meaningful supply-chain risk if those URLs were silently swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:32 "catpaw-cn-${pkgver}.dmg::https://s3plus.meituan.net/catpaw-external-resources/ide/darwin/stable/${pkgver}/妙手.20261016004642.dmg"
  • PKGBUILD:34 "node-v${_electron}-headers.tar.gz::https://artifacts.electronjs.org/headers/dist/v${_electron}/node-v${_electron}-headers.tar.gz"
Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Two prebuilt binaries (catpaw-cli-linux-x64 and agent-browser-linux-x64) are downloaded from non-official/personal-style hosts (s3plus.meituan.net and vercel-labs GitHub) and executed at runtime; while checksums are provided and the Meituan host is plausibly the vendor's own CDN, these are unverifiable prebuilt executables from hosts outside the project's primary official infrastructure, representing a meaningful supply-chain risk if those URLs were silently swapped.

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: mensylisir <710080675@qq.com>
2
3pkgname=catpaw-cn
4pkgver=2026.1016.0034
5pkgrel=1
6_electron=42.11.2
7_node=24.18.0
8_python=3.12.13
9pkgdesc='妙手 AI Agent 桌面应用（国内版），非官方 Linux 移植'
10arch=('x86_64')
11url='https://catpaw.meituan.com/'
12license=('custom')
13depends=(
14 'gtk3' 'nss' 'alsa-lib' 'libcups' 'libdrm' 'libx11' 'libxcb'
15 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxi'
16 'libxkbcommon' 'libxrandr' 'mesa' 'libsecret'
17 'libappindicator' 'libpulse' 'json-glib' 'wayland' 'systemd-libs' 'dbus'
18 'libnotify'
19)
20makedepends=('7zip' 'unzip' 'nodejs' 'node-gyp' 'python' 'gcc' 'make')
21optdepends=(
22 'libreoffice-fresh: PPTX 转 PDF/图片'
23 'poppler: PDF 渲染与转换（pdftoppm）'
24 'pandoc-cli: DOCX 高级文本转换'
25 'tesseract: OCR 识别'
26 'qpdf: PDF 处理'
27 'gnome-keyring: 系统密钥环支持'
28)
29options=('!strip' '!debug' '!lto')
30
31source=(
32 "catpaw-cn-${pkgver}.dmg::https://s3plus.meituan.net/catpaw-external-resources/ide/darwin/stable/${pkgver}/妙手.20261016004642.dmg"
33 "electron-v${_electron}-linux-x64.zip::https://github.com/electron/electron/releases/download/v${_electron}/electron-v${_electron}-linux-x64.zip"
34 "node-v${_electron}-headers.tar.gz::https://artifacts.electronjs.org/headers/dist/v${_electron}/node-v${_electron}-headers.tar.gz"
35 "node-v${_node}-linux-x64.tar.gz::https://nodejs.org/dist/v${_node}/node-v${_node}-linux-x64.tar.gz"
36 "cpython-${_python}-linux-x64-install_only.tar.gz::https://github.com/astral-sh/python-build-standalone/releases/download/20260807/cpython-${_python}%2B20260807-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
37 'node-pty-1.1.0.tgz::https://registry.npmjs.org/node-pty/-/node-pty-1.1.0.tgz'
38 'node-addon-api-7.1.1.tgz::https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz'
39 'bufferutil-4.1.0.tgz::https://registry.npmjs.org/bufferutil/-/bufferutil-4.1.0.tgz'
40 'utf-8-validate-6.0.6.tgz::https://registry.npmjs.org/utf-8-validate/-/utf-8-validate-6.0.6.tgz'
41 'better-sqlite3-v12.11.1-electron-v146-linux-x64.tar.gz::https://github.com/WiseLibs/better-sqlite3/releases/download/v12.11.1/better-sqlite3-v12.11.1-electron-v146-linux-x64.tar.gz'
42 'koffi-linux-x64-3.2.0.tgz::https://registry.npmjs.org/@koromix/koffi-linux-x64/-/koffi-linux-x64-3.2.0.tgz'
43 'sharp-linux-x64-0.35.2.tgz::https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.35.2.tgz'
44 'sharp-libvips-linux-x64-1.3.1.tgz::https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.3.1.tgz'
45 'canvas-linux-x64-gnu-1.0.8.tgz::https://registry.npmjs.org/@napi-rs/canvas-linux-x64-gnu/-/canvas-linux-x64-gnu-1.0.8.tgz'
46 'wecom-cli-linux-x64-1.1.0.tgz::https://registry.npmjs.org/@wecom/cli-linux-x64/-/cli-linux-x64-1.1.0.tgz'
47 'ffmpeg-linux-x64-4.1.0.tgz::https://registry.npmjs.org/@ffmpeg-installer/linux-x64/-/linux-x64-4.1.0.tgz'
48 'agent-browser-linux-x64::https://github.com/vercel-labs/agent-browser/releases/download/v0.27.3/agent-browser-linux-x64'
49 'catpaw-cli-linux-x64::https://s3plus.meituan.net/mcopilot-pub/cli/v1.2.0-beta.33/catpaw-cli-linux-x64'
50 'convert.sh'
51 'repack-asar.js'
52 'patch-skill-manifests.js'
53 'catpaw-cn.sh'
54 'catpaw-moon.desktop'
55 'catpaw-moon-16.png'
56 'catpaw-moon-24.png'
57 'catpaw-moon-32.png'
58 'catpaw-moon-48.png'
59 'catpaw-moon-64.png'
60 'catpaw-moon-128.png'
61 'catpaw-moon-256.png'
62 'catpaw-moon-512.png'
63 'DISCLAIMER'
64 'LICENSE.port-scripts'
65)
66sha256sums=(
67 '3c931da843e32128e4e3431f50231fac38f3b6f1c2a850bc9e783cc4d4deb3cf'
68 '1e0b2a6d59bb8836858a24dec454c36e15a904dd1000a1053c8e36ecc44333bc'
69 'b586bf9cc6352053f9e075ed06a160a42653971742fd1746e8951e6942d55879'
70 '783130984963db7ba9cbd01089eaf2c2efb055c7c1693c943174b967b3050cb8'
71 '506191be3ee7bd190a8834dcdc1b3bc70aab50608deccc711935aa007239cabd'
72 'c7517f19083ddcb05f276904680eb2b11a6b5ecab778b8e4e5685a6d645b3f60'
73 'b10455d15a977c0cd17a1cb0eb679e03d939f8ef8d4302eb33e1f78dacc71f82'
74 '19af5978088739b8baf861a95ab4a1feb69a2d30830ced707c37920591046a87'
75 'f65e05feb1174937bd67b5ddb7a70d5eed314989d2bc8637e1594e1623c4a00f'
76 'e2021aeed80de4f15212525e30565756aaae790e68e3229df6d1345f43803221'
77 'c7f6cecb66c5ca9db08b0dd6b4f77ea52a01c45357fdd8a80c1bf2fa8382b44e'
78 '347e7db22852b7718e99862a558ca57a271bc9c1810cdf23c212caeb0aa622e3'
79 '61b2c772f5945683f1b315f277ac25eafa98c34fb9eaddd31342c47451d35f38'
80 '05032e8d7f5197bda600d3557facb51c7799811eaf4965d9b2d4d084ec13557d'
81 '8da74fecd9b89a92876e72d663dad5e436c771c91bb051d99b2eb63a1d889516'
82 'b836abe532912ae6c3388dbe713952af293a3d005fc9e4d34d52f14da99dda71'
83 '373f010e2f915c026f2a50b79f0676b8deace93372af43b82ce20a7737764353'
84 'e83b727a0a254bda3c4d0c70af9ceb13509eea6da414b4fa5be90e5ae679066d'
85 '225a5483ceb76a2985ffc31db4c5aee38408869c14fa308f33f5ff7896b72875'
86 'ef50b80ae1d55a5f48c94db21cf74c3543723af4e89f85eb9d80c0900b1efdf1'
87 'ffa303d2f54724e538f4696cc7e108d7b73c254e92250f1cd2a0ac583aee22a6'
88 '5a7bc6a574ef7ac498c45b4e81132ac769ec7c7235b7125e705d8e14764d9367'
89 '88167f36a093afafaa9fd385b8f5ac9ea3486c4d1b70091ff658adaacaeb6974'
90 '1417ab53a79538a6ea2aadb15bb6828d6e499a9c9e69aa6d08fe0f886c4506b3'
91 '67cdc71e790ae8990b7df87a90b37201b86f90c5c7182b8be55f05405937f188'
92 '9ad1f9a0bb5d6bd3128abd29a4f1801d3739ec430d171bde95a0eda64dad5b65'
93 '4d8781235ff635581788c54c01a9e2af73ca78c4ab03266d8e3b8a4b26f61751'
94 '8d01a72cd4531678a5d58cbf06c4a388ef9a8c52af307ffb40574f1718e7c174'
95 'eab6bad262f114544788fae5879557b004a5c1edb69ac47b44a6ced7c7b99b57'
96 'b1588a93ec6e6c9f05b7a19c7a9b2ad7f3cfe8557b69bf5ce69f9e61dd97bf72'
97 '3e6cf4220a141f3d42a1b3140c9abcae60ae4bb250331a18d44a944c76b8d1e9'
98 '8a8c57d9a0ca52cbf9a124410d2615fbdb5942d8239d5da15f26e3d01909d06d'
99 'ff3fd1025ab5883825f6bf3f062a05bce6478acba8b75d305664096167241f42'
100)
101
102# convert.sh performs its own extraction, so keep the downloaded archives intact.
103noextract=(
104 "catpaw-cn-${pkgver}.dmg"
105 "electron-v${_electron}-linux-x64.zip"
106 "node-v${_electron}-headers.tar.gz"
107 "node-v${_node}-linux-x64.tar.gz"
108 "cpython-${_python}-linux-x64-install_only.tar.gz"
109 'node-pty-1.1.0.tgz'
110 'node-addon-api-7.1.1.tgz'
111 'bufferutil-4.1.0.tgz'
112 'utf-8-validate-6.0.6.tgz'
113 'better-sqlite3-v12.11.1-electron-v146-linux-x64.tar.gz'
114 'koffi-linux-x64-3.2.0.tgz'
115 'sharp-linux-x64-0.35.2.tgz'
116 'sharp-libvips-linux-x64-1.3.1.tgz'
117 'canvas-linux-x64-gnu-1.0.8.tgz'
118 'wecom-cli-linux-x64-1.1.0.tgz'
119 'ffmpeg-linux-x64-4.1.0.tgz'
120 'agent-browser-linux-x64'
121 'catpaw-cli-linux-x64'
122)
123
124build() {
125 export APP_DMG="$srcdir/catpaw-cn-${pkgver}.dmg"
126 export ELECTRON_ZIP="$srcdir/electron-v${_electron}-linux-x64.zip"
127 export ELECTRON_HEADERS_TGZ="$srcdir/node-v${_electron}-headers.tar.gz"
128 export NODE_TARBALL="$srcdir/node-v${_node}-linux-x64.tar.gz"
129 export PYTHON_TARBALL="$srcdir/cpython-${_python}-linux-x64-install_only.tar.gz"
130 export NODE_PTY_TGZ="$srcdir/node-pty-1.1.0.tgz"
131 export NODE_ADDON_API_TGZ="$srcdir/node-addon-api-7.1.1.tgz"
132 export BUFFERUTIL_TGZ="$srcdir/bufferutil-4.1.0.tgz"
133 export UTF8_VALIDATE_TGZ="$srcdir/utf-8-validate-6.0.6.tgz"
134 export BETTER_SQLITE3_TGZ="$srcdir/better-sqlite3-v12.11.1-electron-v146-linux-x64.tar.gz"
135 export KOFFI_TGZ="$srcdir/koffi-linux-x64-3.2.0.tgz"
136 export SHARP_TGZ="$srcdir/sharp-linux-x64-0.35.2.tgz"
137 export SHARP_LIBVIPS_TGZ="$srcdir/sharp-libvips-linux-x64-1.3.1.tgz"
138 export CANVAS_TGZ="$srcdir/canvas-linux-x64-gnu-1.0.8.tgz"
139 export WECOM_TGZ="$srcdir/wecom-cli-linux-x64-1.1.0.tgz"
140 export FFMPEG_LINUX_TGZ="$srcdir/ffmpeg-linux-x64-4.1.0.tgz"
141 export CATPAW_CLI_BIN="$srcdir/catpaw-cli-linux-x64"
142 export AGENT_BROWSER_BIN="$srcdir/agent-browser-linux-x64"
143 export WORK_DIR="$srcdir/build-work"
144 export OUT_DIR="$srcdir/app-out"
145 export ELECTRON_VER="$_electron"
146 export NODE_VER="$_node"
147 export PYTHON_VER="$_python"
148
149 bash "$srcdir/convert.sh"
150}
151
152package() {
153 install -dm755 "$pkgdir/opt"
154 cp -a "$srcdir/app-out" "$pkgdir/opt/catpaw-cn"
155
156 install -Dm755 "$srcdir/catpaw-cn.sh" "$pkgdir/usr/bin/catpaw-cn"
157 install -Dm644 "$srcdir/catpaw-moon.desktop" \
158 "$pkgdir/usr/share/applications/catpaw-moon.desktop"
159
160 local size
161 for size in 16 24 32 48 64 128 256 512; do
162 install -Dm644 "$srcdir/catpaw-moon-${size}.png" \
163 "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/catpaw-moon.png"
164 done
165
166 install -Dm644 "$srcdir/app-out/LICENSE" \
167 "$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron"
168 install -Dm644 "$srcdir/DISCLAIMER" "$pkgdir/usr/share/licenses/$pkgname/DISCLAIMER"
169 install -Dm644 "$srcdir/LICENSE.port-scripts" \
170 "$pkgdir/usr/share/licenses/$pkgname/LICENSE.port-scripts"
171}
172

Scan history

Scanned at (UTC)SeverityRules
2026-11-03 00:08:24 Medium 3
2026-11-03 00:04:01 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion