visor

The static rules flagged this HIGH, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it MEDIUM (confidence 72%): The PKGBUILD itself is clean: it downloads a versioned tarball from GitHub with a pinned sha256sum, builds from source using gnu-efi, and installs files normally. The flagged pattern in the .install file (line 14) is not actually executed code - it is an `echo` statement that prints a curl-pipe-sh one-liner as a suggestion to the user. The script never actually runs `curl | sh`; it only displays the command as documentation. However, this is still a meaningful concern: printing a `sh -c "$(curl -fsSL ...)"` command pointing to a mutable `main` branch script (not a pinned commit or tag) in a post-install message actively encourages users to execute an unverified remote script. This is a supply-chain risk pattern (the GitHub `main` branch URL could be updated to serve malicious content at any time), but since the PKGBUILD itself does not execute it, it does not rise to HIGH/RCE. It is rated medium because it actively promotes execution of an unaudited, mutable remote shell script as an alternative installation path.