picoclaw-bin

MEDIUM

maintainer tee 0 votes scanned 2026-08-19 05:41:16.641961

View on AUR

Why flagged

The package installs a prebuilt .deb from GitHub releases, which is an unverifiable binary executable; if the source were swapped, it could lead to code execution, though the host (GitHub) is generally trustworthy.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt .deb from GitHub releases, which is an unverifiable binary executable; if the source were swapped, it could lead to code execution, though the host (GitHub) is generally trustworthy.

PKGBUILD

      1# Maintainer: tee < teeaur at duck dot com >
    
      2pkgname=picoclaw-bin
    
      3pkgver=0.3.1
    
      4pkgrel=1
    
      5pkgdesc="Ultra-Efficient AI Assistant in Go"
    
      6arch=(x86_64)
    
      7url="https://picoclaw.io"
    
      8license=(MIT)
    
      9depends=(hicolor-icon-theme)
    
      10provides=(picoclaw)
    
      11conflicts=(picoclaw)
    
      12#source=("picoclaw-$pkgver.tgz::https://github.com/sipeed/picoclaw/releases/download/v$pkgver/picoclaw_Linux_x86_64.tar.gz")
    
      13source=("picoclaw-$pkgver.deb::https://github.com/sipeed/picoclaw/releases/download/v$pkgver/picoclaw_x86_64.deb")
    
      14b2sums=('b14b44fea03ca6ef4bc02f924c773a69542732d578cc6285ff7a641a3929a5304e2a7384377e6489eed1b487da40e9daf8c6870dd0315b4f4e4ac90fcff21b2c')
    
      15
    
      16package() {
    
      17  tar -xf data.tar.gz -C "$pkgdir"
    
      18}
    
      19

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-19 05:41:16	Medium	2