msty-claw-bin

MEDIUM

maintainer jeryd 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

This PKGBUILD installs a prebuilt proprietary binary (.deb) downloaded from next-assets.msty.studio, which is the vendor's own CDN/asset host for the Msty Claw application. The URL uses a query parameter (?ver=) to pin the version, and a sha256sum IS provided (not SKIP), so integrity is verified at download time. The main concern is that this is a closed-source, prebuilt binary from a non-official distribution channel (not a distro mirror or well-known release host like GitHub releases), meaning users must trust the vendor's CDN entirely. If the CDN is compromised or the vendor pushes a malicious update, the sha256 would catch it only for the pinned version — but the URL itself always fetches 'latest', so the checksum provides real protection only if the file at that URL hasn't changed. This is a standard medium-risk pattern for proprietary binary AUR packages: not clearly malicious, but a real supply-chain trust concern due to the prebuilt binary from a vendor-controlled host with a mutable 'latest' URL (mitigated somewhat by the sha256 check).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("$filename::https://next-assets.msty.studio/mstyclaw/latest/linux/MstyClaw_amd64.deb?ver=$pkgver")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs a prebuilt proprietary binary (.deb) downloaded from next-assets.msty.studio, which is the vendor's own CDN/asset host for the Msty Claw application. The URL uses a query parameter (?ver=) to pin the version, and a sha256sum IS provided (not SKIP), so integrity is verified at download time. The main concern is that this is a closed-source, prebuilt binary from a non-official distribution channel (not a distro mirror or well-known release host like GitHub releases), meaning users must trust the vendor's CDN entirely. If the CDN is compromised or the vendor pushes a malicious update, the sha256 would catch it only for the pinned version — but the URL itself always fetches 'latest', so the checksum provides real protection only if the file at that URL hasn't changed. This is a standard medium-risk pattern for proprietary binary AUR packages: not clearly malicious, but a real supply-chain trust concern due to the prebuilt binary from a vendor-controlled host with a mutable 'latest' URL (mitigated somewhat by the sha256 check).

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: jeryd leuck <jerydleuck@gmail.com>
    
      2pkgname=msty-claw-bin
    
      3pkgver=0.7.0
    
      4pkgrel=1
    
      5pkgdesc="Msty Claw is an autonomous AI agent application designed for complex task orchestration (Beta)"
    
      6arch=('x86_64')
    
      7url="https://msty.ai/claw"
    
      8license=('custom:proprietary')
    
      9depends=('gtk3' 'webkit2gtk-4.1' 'openssl' 'libdbus' 'libglvnd' 'hicolor-icon-theme')
    
      10optdepends=('cuda: NVIDIA GPU acceleration'
    
      11            'rocm-core: AMD GPU acceleration'
    
      12            'docker: Intel GPU acceleration (via ipex-llm container workaround)'
    
      13            'libpulse: PulseAudio/Pipewire support')
    
      14provides=('msty-claw')
    
      15conflicts=('msty-claw')
    
      16filename="MstyClaw_amd64_${pkgver}.deb"
    
      17source=("$filename::https://next-assets.msty.studio/mstyclaw/latest/linux/MstyClaw_amd64.deb?ver=$pkgver")
    
      18sha256sums=('d05967d6ce920b865b1b58cb6612e68b1f0426e4b00e3f07c29b89c50d83156d')
    
      19
    
      20prepare() {
    
      21  mkdir -p "$srcdir/pkg-contents"
    
      22  bsdtar -xOf "$srcdir/$filename" data.tar.gz | bsdtar -C "$srcdir/pkg-contents" -xv
    
      23}
    
      24
    
      25check() {
    
      26  find "$srcdir/pkg-contents" -type f -exec sh -c 'file "$1" | grep -q ELF' _ {} \; -print | while read -r elf; do
    
      27    if ldd "$elf" | grep -q "not found"; then
    
      28      echo "Broken dependencies in $elf:"
    
      29      ldd "$elf" | grep "not found"
    
      30      exit 1
    
      31    fi
    
      32  done
    
      33}
    
      34
    
      35package() {
    
      36  # Copy extracted files to pkgdir (do not preserve ownership to support container builds)
    
      37  cp -a --no-preserve=ownership "$srcdir/pkg-contents/." "$pkgdir/"
    
      38
    
      39  # Create symlink for terminal access
    
      40  install -d "$pkgdir/usr/bin"
    
      41  ln -sf /usr/bin/MstyClaw "$pkgdir/usr/bin/msty-claw"
    
      42
    
      43  # Install Licenses
    
      44  install -Dm644 "$pkgdir/usr/lib/Msty Claw/_up_/THIRD_PARTY_NOTICES.txt" "$pkgdir/usr/share/licenses/$pkgname/THIRD_PARTY_NOTICES.txt"
    
      45}
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2