remotemouse

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=("https://www.remotemouse.net/downloads/linux/RemoteMouse_x86_64.zip"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary (RemoteMouse) from remotemouse.net, the official vendor website for the Remote Mouse application. This is the legitimate upstream source for this proprietary closed-source application. However, the concern is real: a prebuilt executable from a proprietary vendor is installed directly to /opt and executed, with no source build. The vendor host (remotemouse.net) is the official site, so this is not an unofficial/personal host — it is the canonical distribution point for this software. The md5sums provide minimal integrity checking (MD5 is weak but present). The main risk is the typical supply-chain concern of any prebuilt proprietary binary: if the vendor's server is compromised or the binary is malicious, it executes with user privileges. This is a standard medium-risk pattern for AUR packages distributing prebuilt proprietary binaries from official vendor sites — not a false positive, but also not an active attack. The cheaper model's assessment is essentially correct in classification, though the framing slightly overstates the concern by calling it 'non-standard' when it is actually the official vendor host.