wizdom.ai

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary application (NW.js app tarball) from app.wizdom.ai via a dynamic/versioned endpoint with SKIP'd checksum verification, then installs it to /opt for execution. The concerns are real but not clearly malicious: (1) sha256sums=SKIP means no integrity check — the server can silently serve different content at any time; (2) the source URL is a dynamic endpoint (wizdomUpdate?app=...) rather than a static versioned release artifact, making reproducibility impossible; (3) the downloaded content is an executed binary application installed to /opt, not mere data. However, app.wizdom.ai is the official vendor's own domain (matching the package's stated url of wizdom.ai), so this is the vendor's own distribution channel rather than a third-party or personal host. The pattern is sloppy and risky (no checksum, dynamic URL) but consistent with a proprietary vendor distributing their own app through AUR — similar to how some other proprietary desktop apps are packaged. The medium rating is appropriate: it's a real supply-chain concern (no integrity verification of an executed binary) but not evidence of active malice.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("$pkgname-$pkgver.tar::https://app.wizdom.ai/wizdomUpdate?app=wizdom.ai.installer.v3.nix.64")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary application (NW.js app tarball) from app.wizdom.ai via a dynamic/versioned endpoint with SKIP'd checksum verification, then installs it to /opt for execution. The concerns are real but not clearly malicious: (1) sha256sums=SKIP means no integrity check — the server can silently serve different content at any time; (2) the source URL is a dynamic endpoint (wizdomUpdate?app=...) rather than a static versioned release artifact, making reproducibility impossible; (3) the downloaded content is an executed binary application installed to /opt, not mere data. However, app.wizdom.ai is the official vendor's own domain (matching the package's stated url of wizdom.ai), so this is the vendor's own distribution channel rather than a third-party or personal host. The pattern is sloppy and risky (no checksum, dynamic URL) but consistent with a proprietary vendor distributing their own app through AUR — similar to how some other proprietary desktop apps are packaged. The medium rating is appropriate: it's a real supply-chain concern (no integrity verification of an executed binary) but not evidence of active malice.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yifei Wu <kqwyfg@gmail.com>
    
      2
    
      3pkgname=wizdom.ai
    
      4pkgver=3.20.0907
    
      5pkgrel=1
    
      6pkgdesc="The desktop application for wizdom.ai Library."
    
      7arch=('x86_64')
    
      8url="https://www.wizdom.ai"
    
      9license=('unknown')
    
      10depends=()
    
      11provides=('wizdom.ai')
    
      12options=()
    
      13source=("$pkgname-$pkgver.tar::https://app.wizdom.ai/wizdomUpdate?app=wizdom.ai.installer.v3.nix.64")
    
      14sha256sums=("SKIP")
    
      15
    
      16pkgver() {
    
      17    cd "$srcdir/$pkgname"
    
      18    echo $(sed "s/,/\n/g" package.nw/package.json | grep "\"version\"" | cut -d ":" -f 2 | cut -d "\"" -f 2)
    
      19}
    
      20
    
      21package() {
    
      22    # install icons
    
      23    install -dm755 "$pkgdir/usr/share/icons"
    
      24    cp -dpr --no-preserve=ownership "wizdom.ai/package.nw/icon_app_win.png" "$pkgdir/usr/share/icons/wizdom.ai.png"
    
      25
    
      26    # add icon to the .desktop file
    
      27    cp "wizdom.ai/wizdom.ai.desktop" "wizdom.ai/wizdom.ai.desktop.new.1"
    
      28    echo "Icon=wizdom.ai" >> "wizdom.ai/wizdom.ai.desktop.new.1"
    
      29
    
      30    # fix "Exec=" in the .desktop file
    
      31    sed "s/Exec=.*/Exec=bash -c '\/opt\/wizdom.ai\/wizdom.ai' dummy %k/g" "wizdom.ai/wizdom.ai.desktop.new.1" > "wizdom.ai/wizdom.ai.desktop.new.2"
    
      32
    
      33    # fix "NoDisplay" in the .desktop file
    
      34    grep -v "NoDisplay" "wizdom.ai/wizdom.ai.desktop.new.2" > "wizdom.ai/wizdom.ai.desktop.new.3"
    
      35
    
      36    # install .desktop file and remove the temporary .desktop files
    
      37    install -Dm644 "wizdom.ai/wizdom.ai.desktop.new.3" "$pkgdir/usr/share/applications/wizdom.ai.desktop"
    
      38    rm "wizdom.ai/wizdom.ai.desktop.new.1" "wizdom.ai/wizdom.ai.desktop.new.2" "wizdom.ai/wizdom.ai.desktop.new.3"
    
      39
    
      40    # install all the files to /opt
    
      41    install -dm755 "$pkgdir/opt"
    
      42    cp -dpr --no-preserve=ownership "wizdom.ai" "$pkgdir/opt"
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2