remote-benben-appimage

MEDIUM

maintainer ParadiseofMagic 0 votes scanned 2026-10-06 00:19:23.678998

View on AUR

Why flagged

A prebuilt AppImage binary is downloaded from chiselapp.com (a personal/niche Fossil SCM hosting service), which is not the project's own official release infrastructure and could be silently swapped; however, the checksum is present and the URL is plausibly the project's own repository, keeping this at medium rather than high.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 https://chiselapp.com/user/MistressRemilia/repository/benben/uv/"${_appimage}"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): A prebuilt AppImage binary is downloaded from chiselapp.com (a personal/niche Fossil SCM hosting service), which is not the project's own official release infrastructure and could be silently swapped; however, the checksum is present and the URL is plausibly the project's own repository, keeping this at medium rather than high.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Keon Cachia <keonfarrugia@gmail.com>
    
      2
    
      3pkgname=remote-benben-appimage
    
      4pkgver=0.3.0
    
      5pkgrel=1
    
      6pkgdesc="A tool to control benben from an unix socket"
    
      7arch=("x86_64")
    
      8url="https://chiselapp.com/user/MistressRemilia/repository/benben/home"
    
      9license=('AGPL-3.0-or-later')
    
      10depends=("fuse2"
    
      11	"benben")
    
      12provides=("remote-benben")
    
      13conflicts=("remote-benben")
    
      14options=("!strip")
    
      15_pkgname=remote-benben
    
      16_appimage="${_pkgname}"-"${pkgver}"-x86_64.AppImage
    
      17source=(
    
      18    https://chiselapp.com/user/MistressRemilia/repository/benben/uv/"${_appimage}"
    
      19)
    
      20sha256sums=('8c7496fddbe44a10feb4e0cbab7b733e008dbdf998adda3092437587ecfb8366')
    
      21
    
      22package() {
    
      23  install -Dm755 "${_appimage}" "${pkgdir}/usr/bin/remote-benben"
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:19:23	Medium	3
2026-10-06 00:13:36	Medium	3
2026-10-05 23:40:58	Medium	3