clawdbot

maintainer lumirfiala · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a Node.js application from the official npm registry, which is a trusted source; the build process is standard for npm packages and poses no inherent risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a Node.js application from the official npm registry, which is a trusted source; the build process is standard for npm packages and poses no inherent risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: JBeard <beardcoin@protonmail.com>
    
      2pkgname=clawdbot
    
      3_npmver=2026.1.24-3
    
      4pkgver=2026.1.24.3
    
      5pkgrel=1
    
      6pkgdesc="Personal AI assistant supporting Claude, Ollama, and other LLMs - the lobster way 🦞"
    
      7arch=('any')
    
      8url="https://github.com/clawdbot/clawdbot"
    
      9license=('MIT')
    
      10depends=('nodejs>=22')
    
      11optdepends=(
    
      12    'ollama: Local LLM support'
    
      13    'chromium: Browser automation features'
    
      14)
    
      15source=("https://registry.npmjs.org/${pkgname}/-/${pkgname}-${_npmver}.tgz")
    
      16noextract=("${pkgname}-${_npmver}.tgz")
    
      17sha256sums=('a00acd33ac20787fbd342db2bc36db15b2483f88e1f8b159cf1bc37a6eb1a828')
    
      18
    
      19package() {
    
      20    # Install using npm to a prefix
    
      21    npm install -g \
    
      22        --prefix "${pkgdir}/usr" \
    
      23        --cache "${srcdir}/npm-cache" \
    
      24        "${srcdir}/${pkgname}-${_npmver}.tgz"
    
      25
    
      26    # Fix permissions (npm installs as root with weird perms)
    
      27    find "${pkgdir}/usr" -type d -exec chmod 755 {} +
    
      28    find "${pkgdir}/usr" -type f -exec chmod 644 {} +
    
      29    chmod 755 "${pkgdir}/usr/bin/"* 2>/dev/null || true
    
      30
    
      31    # Make node files executable
    
      32    find "${pkgdir}/usr/lib/node_modules/${pkgname}" -name "*.js" -path "*/bin/*" -exec chmod 755 {} + 2>/dev/null || true
    
      33
    
      34    # Install license from the package
    
      35    install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      36    if [[ -f "${pkgdir}/usr/lib/node_modules/${pkgname}/LICENSE" ]]; then
    
      37        ln -s "/usr/lib/node_modules/${pkgname}/LICENSE" \
    
      38            "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      39    fi
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0