kendex

LOW

maintainer vanillagreen 0 votes scanned 2026-08-20 05:10:41.769601

View on AUR

Why flagged

The package downloads a prebuilt binary from a GitHub release under the maintainer's domain, which is a supply-chain risk if the host is compromised, but there is no evidence of malicious behavior or code execution beyond installing the binary as intended.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt binary from a GitHub release under the maintainer's domain, which is a supply-chain risk if the host is compromised, but there is no evidence of malicious behavior or code execution beyond installing the binary as intended.

PKGBUILD

      1# Maintainer: VanillaGreen <ai1@vanillagreen.com>
    
      2pkgname=kendex
    
      3pkgver=5.0.1
    
      4pkgrel=1
    
      5pkgdesc='Package manager for agents, skills, and hooks across AI coding tools'
    
      6arch=('x86_64')
    
      7url='https://kendex.ai'
    
      8license=('MIT')
    
      9provides=('kendex')
    
      10conflicts=('kendex-git')
    
      11options=('!strip')
    
      12source=("kendex-$pkgver::https://github.com/vanillagreencom/kendex/releases/download/v$pkgver/kendex-x86_64-unknown-linux-gnu")
    
      13sha256sums=('a3dee4c286614016198db72603fcf95de277ddf1a245da052dc815821f0e84c0')
    
      14
    
      15package() {
    
      16  install -Dm755 "$srcdir/kendex-$pkgver" "$pkgdir/usr/bin/kendex"
    
      17}
    
      18

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-20 05:10:41	Low	2