shuck-bin
The package downloads a prebuilt binary from the project's official GitHub releases, which is a normal and expected practice; the low severity is due to the static rule about few votes and recent upload, not due to any malicious or risky behavior in the PKGBUILD itself.
Triggered rules
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt binary from the project's official GitHub releases, which is a normal and expected practice; the low severity is due to the static rule about few votes and recent upload, not due to any malicious or risky behavior in the PKGBUILD itself.
PKGBUILD
# Maintainer: Eisuke Kawashima <e DOT kawaschima+archlinux AT gmail DOT com>
pkgname=shuck-bin
pkgdesc='A lightning fast shell linter/formatter/LSP server'
pkgver=0.2.1
pkgrel=1
url='https://ewhauser.github.io/shuck/'
arch=('x86_64')
license=('MIT')
depends=('libgcc')
provides=("${pkgname%-bin}=${pkgver}")
conflicts=("${pkgname%-bin}")
options=('!debug' '!strip')
source_x86_64=("shuck-cli-v${pkgver}-x86_64-unknown-linux-gnu.tar.xz::https://github.com/ewhauser/shuck/releases/download/v${pkgver}/shuck-cli-x86_64-unknown-linux-gnu.tar.xz")
sha256sums_x86_64=('733cbedafeec7c6f016723cf89318e719d93136db786d9aa8f0e831a3be2635a')
package() {
cd "${srcdir}/shuck-cli-x86_64-unknown-linux-gnu"
install -Dm755 -t "${pkgdir}/usr/bin/" "${pkgname%-bin}"
install -Dm644 -t "${pkgdir}/usr/share/licenses/${pkgname}/" LICENSE
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-02 15:51:02 | Low | 2 |