skerry

maintainer Neolux_Lee · 0 votes · base skerry-ssh-appimage · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs an unverifiable prebuilt AppImage from a GitHub release, which could be swapped with malicious code; the skipped checksum prevents validation.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs an unverifiable prebuilt AppImage from a GitHub release, which could be swapped with malicious code; the skipped checksum prevents validation.

PKGBUILD

      1# Maintainer: Your Name <your@email.com>
    
      2pkgbase=skerry-ssh-appimage
    
      3pkgname=skerry
    
      4pkgver=0.2.1
    
      5pkgrel=1
    
      6pkgdesc="Cross-platform SSH client with a single core"
    
      7arch=('x86_64')
    
      8url="https://github.com/SeCherkasov/SkerrySSH"
    
      9license=('GPL-3.0-only')
    
      10depends=('fuse2')
    
      11makedepends=()
    
      12optdepends=()
    
      13source=("${pkgname}-${pkgver}-x86_64.AppImage::https://github.com/SeCherkasov/SkerrySSH/releases/download/v${pkgver}/${pkgname^}-${pkgver}-x86_64.AppImage")
    
      14sha256sums=('SKIP')
    
      15
    
      16prepare() {
    
      17    chmod +x "${srcdir}/${pkgname}-${pkgver}-x86_64.AppImage"
    
      18}
    
      19
    
      20build() {
    
      21    # Extract the AppImage contents into a subdirectory
    
      22    cd "${srcdir}"
    
      23    "./${pkgname}-${pkgver}-x86_64.AppImage" --appimage-extract
    
      24}
    
      25
    
      26package() {
    
      27    # Install extracted AppImage tree to /opt
    
      28    install -dm755 "${pkgdir}/opt/${pkgname}"
    
      29    cp -a "${srcdir}/squashfs-root/." "${pkgdir}/opt/${pkgname}/"
    
      30
    
      31    # Make launcher executable (AppRun is a shell script, bin/Skerry is the native binary)
    
      32    chmod +x "${pkgdir}/opt/${pkgname}/AppRun"
    
      33    chmod +x "${pkgdir}/opt/${pkgname}/bin/Skerry"
    
      34
    
      35    # Symlink AppRun into /usr/bin so the app is on $PATH
    
      36    install -dm755 "${pkgdir}/usr/bin"
    
      37    ln -sf "/opt/${pkgname}/AppRun" "${pkgdir}/usr/bin/${pkgname}"
    
      38
    
      39    # Install the .desktop file
    
      40    install -Dm644 "${pkgdir}/opt/${pkgname}/${pkgname}.desktop" \
    
      41        "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      42
    
      43    # Install icon
    
      44    install -Dm644 "${pkgdir}/opt/${pkgname}/${pkgname}.png" \
    
      45        "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname}.png"
    
      46
    
      47    # Fix the Exec and Icon paths in the desktop file to use absolute/system paths
    
      48    sed -i "s|^Exec=.*|Exec=/usr/bin/${pkgname}|" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      49    sed -i "s|^Icon=.*|Icon=${pkgname}|" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 11:17:50	MEDIUM	2