sm64ex-redrawn-60fps-git

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it HIGH (confidence 85%): The localhost ROM source is intentional and documented — the PKGBUILD explicitly tells users to supply their own legally-obtained SM64 ROM at http://localhost/baserom.us.z64 (with a known-good SHA1 in the comments) and uses SKIP for its checksum, meaning it cannot be verified by makepkg but also cannot be injected by a remote attacker since it must be served locally by the user themselves. This is an unusual but not malicious pattern for distributing packages that require proprietary ROM files the maintainer cannot redistribute. The HD Mario asset is fetched from sm64pc.info (a community forum), which is slightly unofficial but is a static file with a sha512sum. The main supply-chain concern is the piracy angle: sm64ex is a port of a reverse-engineered, copyrighted Nintendo ROM, and the package explicitly packages and installs the compiled game binary derived from that ROM. The license field even says 'reverse-engineered and unlicensed'. This constitutes distribution of software derived from copyrighted material without a license, which is a piracy/IP concern. The localhost ROM trick is low-risk from a security standpoint (no remote attacker can substitute it), but the overall package facilitates running pirated Nintendo IP. Security severity is low (no actual attack vector); piracy flag applies.