ugcli

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:10 source=("ugcli-v${pkgver}-linux-amd64::https://osswaf.ugnas.com/pro/ugcli/download/ugcli-v${pkgver}-linux-amd64")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary (no source compilation) from osswaf.ugnas.com, which appears to be the CDN/OSS host for UGNAS (a NAS OS vendor by Ugreen). The developer documentation URL (developer.ugnas.com) and the download host (osswaf.ugnas.com) share the ugnas.com domain, suggesting this is the official vendor distribution channel rather than a random personal host. However, the binary is executed directly with no source code available, the license is listed as 'unknown', and the host is not a well-known forge or package registry. A sha256 checksum is present, which mitigates substitution risk at the point of download, but does not protect against the vendor themselves distributing a malicious binary. This is a classic prebuilt-binary-from-vendor pattern: not clearly malicious, but carries inherent supply-chain risk since users must fully trust the vendor's CDN infrastructure. The medium rating is appropriate: it is an executed binary from a non-standard (though apparently official vendor) host with no source verification possible.