mymedia

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:10 source=("https://s3.amazonaws.com/bizmodeller/MyMediaForAlexa/Release+${pkgver}/mymedia_${pkgver}-1_amd64.deb"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from an S3 bucket (s3.amazonaws.com/bizmodeller/...) rather than from the official mymediaalexa.com domain. While S3 is a common distribution mechanism for small vendors, this bucket is not verifiably controlled by the official project domain, and the artifact is an executed binary installed directly into the system. The sha512sums are present and pin the specific artifact, which mitigates opportunistic tampering but does not address the trust question of whether the bucket owner is the legitimate vendor. The pattern — prebuilt closed-source binary from a personal/unofficial S3 bucket — is a genuine medium-severity supply-chain concern: if the bucket were misconfigured, transferred, or compromised, a malicious binary could be distributed. This is not clearly malicious, but it is not a false positive either; the cheaper model's medium rating is correct.