klamrisk-hero

LOW

maintainer Ketchup901 0 votes scanned 2026-08-30 13:44:19.347148

View on AUR

Why flagged

Downloads a source zip from a non-whitelisted but plausibly project-related host (scene.kryo.se), builds it from source, and has a SHA256 checksum; the main concern is the non-standard host, but this is a small game being compiled locally with no obfuscation or remote code execution.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a source zip from a non-whitelisted but plausibly project-related host (scene.kryo.se), builds it from source, and has a SHA256 checksum; the main concern is the non-standard host, but this is a small game being compiled locally with no obfuscation or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 'http://scene.kryo.se/kryo-klamrisk_hero.zip'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ketchup901 <ketchup901@riseup.net>
    
      2
    
      3pkgname=klamrisk-hero
    
      4pkgver=1
    
      5pkgrel=1
    
      6pkgdesc="Klämrisk Hero game"
    
      7arch=('x86_64' 'i686')
    
      8url="https://www.linusakesson.net/games/klamrisk/index.php"
    
      9license=('custom')
    
      10depends=('libGL.so' 'sdl' 'sdl_ttf' 'glu' 'glibc')
    
      11source=(
    
      12    'http://scene.kryo.se/kryo-klamrisk_hero.zip'
    
      13    'x86_64.patch'
    
      14    'Klamrisk_Hero.desktop'
    
      15)
    
      16sha256sums=(
    
      17    '7dc7b4f043480e2cf6d77f3cba51f463748cd48aaac161e4dd69f732608c8a4b'
    
      18    'eb3b9812ad3e5fe55e9be9e3e6279302f90ef9b865b842774c1b7bb25229988f'
    
      19    '7554e02497ed96795b92149d3f61e6020af003d044a56663bdb4738a6ceea1de'
    
      20)
    
      21options=(!strip !debug)
    
      22_src="kryo-klamrisk_hero/source"
    
      23
    
      24prepare() {
    
      25    if [[ $CARCH == "x86_64" ]]; then
    
      26        cd $_src
    
      27        patch -Np1 < $srcdir/x86_64.patch
    
      28    fi
    
      29}
    
      30
    
      31
    
      32build() {
    
      33    cd $_src
    
      34    make
    
      35}
    
      36
    
      37package() {
    
      38    install -Dm755 $_src/klamrisk -t $pkgdir/usr/bin/
    
      39    install -Dm644 Klamrisk_Hero.desktop -t $pkgdir/usr/share/applications/
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-30 13:44:19	Low	3
2026-08-30 13:42:42	Medium	2