mcc

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it HIGH (confidence 85%): The PKGBUILD downloads and executes an unversioned shell script (install.sh) from mccteam.github.io with sha256sums=('SKIP'), meaning there is zero integrity verification. The script content can change at any time without any indication in the PKGBUILD, and whatever it does — including downloading and executing arbitrary binaries — runs during the build phase. This is a genuine RCE risk: even if the current script is benign, the lack of a pinned checksum means any future or compromised version of that script executes unconditionally. Additionally, installing a binary to /etc/mcc/ rather than a standard path is unusual but not itself malicious. The core issue is executing an unverified, remotely-hosted, mutable shell script during build(), which meets the threshold for HIGH risk.