dim-agent-bin

MEDIUM

maintainer czyt 0 votes scanned 2026-08-26 07:31:48.429226

View on AUR

Why flagged

Installs a prebuilt binary .deb from a non-official, non-project-owned host (dimcode.echooai.com) that is unrelated to the stated project URL (dimagent.com), making it trivially swappable by an unrelated party; the checksum provides a point-in-time integrity check but cannot verify the binary's provenance or future updates.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 source=("DimAgent-${pkgver}.deb::https://dimcode.echooai.com/updates/stable/linux/x64/DimAgent-${pkgver}.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt binary .deb from a non-official, non-project-owned host (dimcode.echooai.com) that is unrelated to the stated project URL (dimagent.com), making it trivially swappable by an unrelated party; the checksum provides a point-in-time integrity check but cannot verify the binary's provenance or future updates.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2pkgname=dim-agent-bin
    
      3pkgver=0.9.13
    
      4pkgrel=2
    
      5pkgdesc='Agent runtime for desktop, terminal, scripts, and editors'
    
      6arch=('x86_64')
    
      7url='https://dimagent.com'
    
      8license=('custom')
    
      9depends=(
    
      10  'gtk3'
    
      11  'libnotify'
    
      12  'libxss'
    
      13  'libxtst'
    
      14  'xdg-utils'
    
      15  'at-spi2-core'
    
      16  'util-linux-libs'
    
      17  'libsecret'
    
      18  'libxi'
    
      19  'glib2'
    
      20  'gdk-pixbuf2'
    
      21  'libxcb'
    
      22)
    
      23optdepends=('libappindicator-gtk3: system tray indicator support')
    
      24options=('!debug' '!strip')
    
      25provides=('dimagent')
    
      26conflicts=('dimagent')
    
      27source=("DimAgent-${pkgver}.deb::https://dimcode.echooai.com/updates/stable/linux/x64/DimAgent-${pkgver}.deb")
    
      28noextract=("DimAgent-${pkgver}.deb")
    
      29sha256sums=('9963404baeda60e99e2e70d5270951312e2a96430e831c80f4ae4c05896c0e21')
    
      30
    
      31package() {
    
      32  local data_member
    
      33  data_member=$(ar t "${srcdir}/DimAgent-${pkgver}.deb" | awk '/^data\.tar\.(gz|bz2|xz|zst|lz4|lzma)$/ { print; exit }')
    
      34  [[ -n "${data_member}" ]] || {
    
      35    echo 'Could not find a supported data archive in the Debian package' >&2
    
      36    return 1
    
      37  }
    
      38
    
      39  ar p "${srcdir}/DimAgent-${pkgver}.deb" "${data_member}" |
    
      40  bsdtar -xf - -C "${pkgdir}"
    
      41  install -dm755 "${pkgdir}/usr/bin"
    
      42  ln -s /opt/DimAgent/DimAgent "${pkgdir}/usr/bin/dimagent"
    
      43  chmod -R u=rwX,go=rX "${pkgdir}"
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-26 07:31:48	Medium	3
2026-08-26 07:29:42	Medium	3