utools

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 source=("https://publish.u-tools.cn/version2/utools_${pkgver}_amd64.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from publish.u-tools.cn, which is the official CDN/distribution host for the uTools application (a legitimate Chinese productivity launcher). The domain is operated by the uTools vendor (u.tools). While not a well-known Western forge, this is the vendor's own distribution infrastructure, analogous to how other proprietary apps distribute via their own CDN. A sha512 checksum is present, mitigating substitution attacks at rest, but the checksum only protects against accidental corruption or a one-time swap — it does not protect against the vendor pushing a malicious update (the version is pinned so this is less of a concern). The real concern is that this installs a closed-source, prebuilt binary from a Chinese vendor's CDN directly into /opt, with no source verification beyond the checksum. This is a legitimate supply-chain concern (executed binary from a non-auditable, non-reproducible source), which warrants medium severity, but there is no evidence of active malice, obfuscation, or piracy.