creature-desktop-bin

maintainer mmarzex · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt AppImage binary from releases.creature.run, which is the project's own release host (matching the upstream URL creature.run). The AppImage is executed during build to extract its contents, and the extracted Electron application is installed system-wide. The sha256sum is pinned, which mitigates casual tampering, but the host is a personal/startup domain with no third-party verification. The core concern is that this is an executed proprietary binary from a non-auditable source: if the domain or release infrastructure is compromised, users would silently receive malicious code. This is a standard medium-risk pattern for binary AUR packages — not clearly malicious, but a real supply-chain concern due to the unofficial host and lack of any code signing or reproducible build verification. The PKGBUILD itself is well-structured with no obfuscation or suspicious behavior.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source=("${pkgname}-${pkgver}.AppImage::https://releases.creature.run/desktop/linux/x64/Creature-${pkgver}-x64.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt AppImage binary from releases.creature.run, which is the project's own release host (matching the upstream URL creature.run). The AppImage is executed during build to extract its contents, and the extracted Electron application is installed system-wide. The sha256sum is pinned, which mitigates casual tampering, but the host is a personal/startup domain with no third-party verification. The core concern is that this is an executed proprietary binary from a non-auditable source: if the domain or release infrastructure is compromised, users would silently receive malicious code. This is a standard medium-risk pattern for binary AUR packages — not clearly malicious, but a real supply-chain concern due to the unofficial host and lack of any code signing or reproducible build verification. The PKGBUILD itself is well-structured with no obfuscation or suspicious behavior.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Max Marze <max@marze.dev>
    
      2pkgname=creature-desktop-bin
    
      3pkgver=0.0.32
    
      4pkgrel=1
    
      5pkgdesc="The Graphical Agent Interface - Build and share MCP Apps for humans and agents working together"
    
      6arch=('x86_64')
    
      7url="https://creature.run"
    
      8license=('custom')
    
      9depends=(
    
      10    'gtk3'
    
      11    'nss'
    
      12    'alsa-lib'
    
      13    'libxss'
    
      14    'libxtst'
    
      15    'xdg-utils'
    
      16    'libsecret'
    
      17    'libayatana-appindicator'
    
      18)
    
      19optdepends=(
    
      20    'libnotify: for desktop notifications'
    
      21)
    
      22provides=('creature-desktop')
    
      23conflicts=('creature-desktop')
    
      24install=${pkgname}.install
    
      25options=('!strip' '!debug')
    
      26source=("${pkgname}-${pkgver}.AppImage::https://releases.creature.run/desktop/linux/x64/Creature-${pkgver}-x64.AppImage")
    
      27sha256sums=('0f89780d9183da006ef2852f08e10112fbb3e6dc0d2c9eb2ede347fcea595330')
    
      28noextract=("${pkgname}-${pkgver}.AppImage")
    
      29
    
      30makedepends=('imagemagick')
    
      31
    
      32prepare() {
    
      33    chmod +x "${srcdir}/${pkgname}-${pkgver}.AppImage"
    
      34    "${srcdir}/${pkgname}-${pkgver}.AppImage" --appimage-extract
    
      35
    
      36    # Generate smaller icon sizes from the 1024x1024 source
    
      37    local _src="${srcdir}/squashfs-root/usr/share/icons/hicolor/1024x1024/apps/creature-desktop-app.png"
    
      38    for _size in 16 24 32 48 64 128 256 512; do
    
      39        mkdir -p "${srcdir}/icons/${_size}x${_size}"
    
      40        magick "${_src}" -resize "${_size}x${_size}" "${srcdir}/icons/${_size}x${_size}/creature-desktop-app.png"
    
      41    done
    
      42}
    
      43
    
      44package() {
    
      45    # Detect the actual binary name (upstream changed from 'Creature' to 'creature' in 0.0.29)
    
      46    local _bin
    
      47    if [[ -f "${srcdir}/squashfs-root/usr/lib/creature-desktop-app/creature" ]]; then
    
      48        _bin="creature"
    
      49    else
    
      50        _bin="Creature"
    
      51    fi
    
      52
    
      53    # Install the main application
    
      54    install -dm755 "${pkgdir}/opt/creature-desktop"
    
      55    cp -r "${srcdir}/squashfs-root/usr/lib/creature-desktop-app/"* "${pkgdir}/opt/creature-desktop/"
    
      56
    
      57    # Install icons at multiple sizes
    
      58    for _size in 16 24 32 48 64 128 256 512; do
    
      59        install -Dm644 "${srcdir}/icons/${_size}x${_size}/creature-desktop-app.png" \
    
      60            "${pkgdir}/usr/share/icons/hicolor/${_size}x${_size}/apps/creature-desktop-app.png"
    
      61    done
    
      62    install -Dm644 "${srcdir}/squashfs-root/usr/share/icons/hicolor/1024x1024/apps/creature-desktop-app.png" \
    
      63        "${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/creature-desktop-app.png"
    
      64
    
      65    # Install the desktop file (patched)
    
      66    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/creature-desktop.desktop" <<EOF
    
      67[Desktop Entry]
    
      68Version=1.5
    
      69Type=Application
    
      70Name=Creature
    
      71Comment=The Graphical Agent Interface
    
      72Exec=/opt/creature-desktop/${_bin} %U
    
      73Icon=creature-desktop-app
    
      74Categories=Development;Utility;
    
      75StartupWMClass=Creature
    
      76EOF
    
      77
    
      78    # Install the license
    
      79    install -Dm644 "${srcdir}/squashfs-root/usr/lib/creature-desktop-app/LICENSE" \
    
      80        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      81
    
      82    # Create symlink for the binary
    
      83    install -dm755 "${pkgdir}/usr/bin"
    
      84    ln -s /opt/creature-desktop/${_bin} "${pkgdir}/usr/bin/creature"
    
      85
    
      86    # Fix permissions for chrome-sandbox
    
      87    chmod 4755 "${pkgdir}/opt/creature-desktop/chrome-sandbox"
    
      88}
    
      89

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2