codepilot-appimage

maintainer Cleboost · 1 votes · scanned 2026-08-18 00:03:42.021799

MEDIUM

Why flagged The package installs a prebuilt AppImage from the project's official GitHub releases, which is executable code that could be swapped by an attacker if the source is compromised, though the project appears legitimate and the checksums are provided.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt AppImage from the project's official GitHub releases, which is executable code that could be swapped by an attacker if the source is compromised, though the project appears legitimate and the checksums are provided.

PKGBUILD

      1# Maintainer: Cleboost <clement.balarot@gmail.com>
    
      2# Contributor: missing-aur project <https://github.com/Cleboost/missing-aur>
    
      3
    
      4pkgname=codepilot-appimage
    
      5pkgver=0.67.1
    
      6pkgrel=1
    
      7pkgdesc="A multi-model AI agent desktop client (AppImage)"
    
      8url="https://github.com/op7418/CodePilot"
    
      9arch=("x86_64" "aarch64")
    
      10depends=("fuse2")
    
      11options=("!strip")
    
      12license=("LicenseRef-BSL-1.1")
    
      13
    
      14source_x86_64=("codepilot-appimage-${pkgver}-x86_64.AppImage::${url}/releases/download/v${pkgver}/CodePilot-${pkgver}-x86_64.AppImage" "codepilot.png::https://raw.githubusercontent.com/op7418/CodePilot/main/build/icon.png" "codepilot.desktop::https://raw.githubusercontent.com/Cleboost/missing-aur/main/packages/codepilot/codepilot.desktop")
    
      15source_aarch64=("codepilot-appimage-${pkgver}-aarch64.AppImage::${url}/releases/download/v${pkgver}/CodePilot-${pkgver}-arm64.AppImage" "codepilot.png::https://raw.githubusercontent.com/op7418/CodePilot/main/build/icon.png" "codepilot.desktop::https://raw.githubusercontent.com/Cleboost/missing-aur/main/packages/codepilot/codepilot.desktop")
    
      16sha256sums_x86_64=('5f03e74dcc6f921cab102ebc8ef3b3a9689021959732c9116cc2141954d76726'
    
      17                   '04c8c070b375f1f0761cb9f0795f09a98969c39201dc651ad46ef61331e66218'
    
      18                   '3f8447e95462a0b92e34e63c1b8b8ada7188a64dde9a9d04bf3799f8673aad4b')
    
      19sha256sums_aarch64=('49f21d70c618a7e79b29bef40a5fb09697d1e848ec92d00c9d9260e4e28d8880'
    
      20                    '04c8c070b375f1f0761cb9f0795f09a98969c39201dc651ad46ef61331e66218'
    
      21                    '3f8447e95462a0b92e34e63c1b8b8ada7188a64dde9a9d04bf3799f8673aad4b')
    
      22
    
      23prepare() {
    
      24  if [ "${CARCH}" = "x86_64" ]; then
    
      25    chmod +x "${srcdir}/codepilot-appimage-${pkgver}-x86_64.AppImage"
    
      26  elif [ "${CARCH}" = "aarch64" ]; then
    
      27    chmod +x "${srcdir}/codepilot-appimage-${pkgver}-aarch64.AppImage"
    
      28  fi
    
      29}
    
      30
    
      31package() {
    
      32  if [ "${CARCH}" = "x86_64" ]; then
    
      33    install -Dm755 "${srcdir}/codepilot-appimage-${pkgver}-x86_64.AppImage" "${pkgdir}/opt/codepilot-appimage/codepilot.AppImage"
    
      34  elif [ "${CARCH}" = "aarch64" ]; then
    
      35    install -Dm755 "${srcdir}/codepilot-appimage-${pkgver}-aarch64.AppImage" "${pkgdir}/opt/codepilot-appimage/codepilot.AppImage"
    
      36  fi
    
      37  install -dm755 "${pkgdir}/usr/bin"
    
      38  ln -sf "/opt/codepilot-appimage/codepilot.AppImage" "${pkgdir}/usr/bin/codepilot"
    
      39  install -Dm644 "${srcdir}/codepilot.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/codepilot.png"
    
      40  install -Dm644 "${srcdir}/codepilot.desktop" "${pkgdir}/usr/share/applications/codepilot.desktop"
    
      41}
    
      42
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	MEDIUM	2
2026-08-17 00:18:29	MEDIUM	2
2026-08-16 15:32:49	MEDIUM	2