video-collector-client

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:10 source=("https://registry.gitflic.ru/project/skylab/video-collector/package/-/generic/video-collector-client/${pkgver}/video-collector-client-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary package (pkg.tar.zst) from gitflic.ru, which is a Russian code-hosting platform analogous to GitHub but not a widely recognized or audited release infrastructure. The critical concerns are: (1) a prebuilt binary is being fetched and presumably installed directly — this is an executed binary from a personal/unofficial host, not built from source; (2) sha256sums is set to 'SKIP', meaning there is zero integrity verification — any substitution of the binary at the source URL would go undetected; (3) gitflic.ru is a personal project host with no established trust model in the Arch packaging ecosystem. The combination of an unverified prebuilt binary from a non-standard host constitutes a genuine supply-chain risk. This is not clearly malicious, but it is a real medium-severity concern: if the host or the project account were compromised, arbitrary code would be installed on users' systems with no checksum protection.