mimocode

MEDIUM

maintainer spiriwind 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

Installs a prebuilt binary (mimo) from Xiaomi's CDN (mi-fds.com) with SKIP'd checksum, making it unverifiable; while the host appears to be Xiaomi's official file distribution service, all checksums are skipped so any tampering would go undetected, and the binary is executed directly rather than built from source.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://mimocode.cnbj1.mi-fds.com/mimocode/mimocode/releases/v${pkgver}/mimocode-linux-x64.tar.gz"

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): Installs a prebuilt binary (mimo) from Xiaomi's CDN (mi-fds.com) with SKIP'd checksum, making it unverifiable; while the host appears to be Xiaomi's official file distribution service, all checksums are skipped so any tampering would go undetected, and the binary is executed directly rather than built from source.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: spiriwind <ruiting_mail@qq.com>
    
      2pkgname=mimocode
    
      3pkgver=0.1.9
    
      4pkgrel=1
    
      5pkgdesc="AI-powered CLI coding agent by Xiaomi MiMo Team"
    
      6arch=('x86_64')
    
      7url="https://mimo.xiaomi.com/coder"
    
      8license=('MIT')
    
      9options=('!strip')
    
      10depends=('nodejs>=18')
    
      11optdepends=('sox: voice input support')
    
      12install="$pkgname.install"
    
      13# Official FDS source (same as https://mimo.xiaomi.com/install script)
    
      14source=("https://mimocode.cnbj1.mi-fds.com/mimocode/mimocode/releases/v${pkgver}/mimocode-linux-x64.tar.gz"
    
      15        "mimocode.bash"
    
      16        "mimocode.fish"
    
      17        "mimocode.1"
    
      18        "mimocode.zh_CN.1")
    
      19sha256sums=('SKIP'
    
      20           'SKIP'
    
      21           'SKIP'
    
      22           'SKIP'
    
      23           'SKIP')
    
      24
    
      25package() {
    
      26    # Binary
    
      27    install -Dm755 "$srcdir/mimo" "$pkgdir/usr/bin/mimo"
    
      28
    
      29    # Bash completion
    
      30    install -Dm644 "$srcdir/mimocode.bash" "$pkgdir/usr/share/bash-completion/completions/mimo"
    
      31
    
      32    # Fish completion
    
      33    install -Dm644 "$srcdir/mimocode.fish" "$pkgdir/usr/share/fish/vendor_completions.d/mimo.fish"
    
      34
    
      35    # Man pages
    
      36    install -Dm644 "$srcdir/mimocode.1" "$pkgdir/usr/share/man/man1/mimo.1"
    
      37    install -Dm644 "$srcdir/mimocode.zh_CN.1" "$pkgdir/usr/share/man/zh_CN/man1/mimo.1"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2