matlab-agentic-toolkit-installer

MEDIUM

maintainer vitaliikuzhdin 0 votes scanned 2026-10-31 11:58:11.931447

View on AUR

Why flagged

The package installs a prebuilt executable from a GitHub release, which is unverifiable and could be swapped; while GitHub is generally trusted, the lack of source code and reliance on a binary from a personal project increases supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt executable from a GitHub release, which is unverifiable and could be swapped; while GitHub is generally trusted, the lack of source code and reliance on a binary from a personal project increases supply-chain risk.

PKGBUILD

      1# Maintainer:  Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
    
      2
    
      3_basename="agentic-toolkit-installer"
    
      4pkgname="matlab-${_basename}"
    
      5pkgver=0.3.0
    
      6pkgrel=1
    
      7pkgdesc="A unified installer for the MATLAB MCP Server, MATLAB Agentic Toolkit and Simulink Agentic Toolkit"
    
      8arch=(
    
      9  'x86_64' # x64
    
      10)
    
      11url="https://github.com/matlab/${_basename}"
    
      12license=(
    
      13  'custom'
    
      14)
    
      15depends=(
    
      16  'matlab-release>=R2021a'
    
      17)
    
      18_pkgsrc="${pkgname}-${pkgver}"
    
      19source=(
    
      20  "${_pkgsrc}-README.md::${url}/raw/refs/tags/v${pkgver}/README.md"
    
      21  "${_pkgsrc}-LICENSE.md::${url}/raw/refs/tags/v${pkgver}/LICENSE.md"
    
      22)
    
      23source_x86_64=(
    
      24  "${_pkgsrc}-x86_64::${url}/releases/download/v${pkgver}/${_basename}-linux-x64"
    
      25)
    
      26sha256sums=('91c39591e1f54c8da7dcd8b6ce2bbafa33993c831843600292c5e8a8671c91af'
    
      27            '2eb513144e31cccd8a8130086d306cefeeb8cd8764246fb81b254a14ac337e99')
    
      28sha256sums_x86_64=('521ab57d587273f6616f62aee679dcc3b8b16d23252193d98cb608c2f4fb1cd5')
    
      29
    
      30package() {
    
      31  cd "${srcdir}"
    
      32  install -vDm755 "${_pkgsrc}-${CARCH}"   "${pkgdir}/usr/bin/${pkgname}"
    
      33  install -vDm644 "${_pkgsrc}-README.md"  "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      34  install -vDm644 "${_pkgsrc}-LICENSE.md" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.md"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-31 11:58:11	Medium	2