twilio-quest-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:12 source=("${pkgname}-${pkgver}.x86_64.zip::https://firebasestorage.googleapis.com/v0/b/twilioquest-prod.appspot.com/o/launchers%2F8%2Ftwilioquest-linux-amd64.zip?alt=media&token=1ad06f1a-c7c8-438d-aa7b-4faf570c8515")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary zip from Firebase Storage (Google's cloud storage, used by Twilio's official Firebase project 'twilioquest-prod.appspot.com'), extracts a .deb from it, and installs the binary content directly without building from source. While Firebase Storage is not a traditional official release host, the bucket name 'twilioquest-prod.appspot.com' strongly suggests this is Twilio's own official distribution channel for TwilioQuest. The md5sum is present but MD5 is cryptographically weak. The core concern is that this is a prebuilt binary from a cloud storage URL with a token parameter — if the token or bucket were compromised or the URL redirected, arbitrary code could be installed. This is a genuine supply-chain concern (executed binary from a non-traditional host), though not clearly malicious. The medium rating is appropriate: it's an official-looking vendor distribution channel but not a traditional release page, and the binary is executed directly on the user's system.