mitalk

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:12 source=("https://s1.zb.mi.com/miliao/apk/miliao/8.8/MiTalk_$pkgver.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb package from s1.zb.mi.com, which is a Xiaomi/Mi subdomain (zb.mi.com is Xiaomi's distribution infrastructure). This is not a random personal host — it is Xiaomi's own CDN/distribution server for their MiTalk (miliao) application. The URL pattern matches Xiaomi's known software distribution infrastructure. However, it is still a prebuilt binary blob from a vendor CDN rather than source-built, and the sha512sum has only 127 hex characters (should be 128 for SHA-512), suggesting a possible truncation error in the checksum. The binary is extracted and installed directly to /opt/MiTalk and executed as mitalk. This is a legitimate vendor binary distribution pattern (similar to how many proprietary apps like Slack, Discord, etc. are packaged in AUR), but the truncated/incorrect sha512sum weakens integrity verification. The medium rating is appropriate: it's a prebuilt executable from a vendor host with a potentially broken checksum, not clearly malicious but representing a real supply-chain concern due to the integrity verification issue.