workbuddy-agent

MEDIUM

maintainer lzsnyy 0 votes scanned 2026-11-03 12:09:28.176153

View on AUR

Why flagged

Installs a prebuilt proprietary .deb binary from download.codebuddy.cn (a non-official, vendor-controlled host unrelated to any well-known project infrastructure) with no way to verify authenticity beyond a checksum; additionally bundles a prebuilt better-sqlite3 native module from npmjs.org with a fixed checksum, which is acceptable but the combination of a closed-source Electron app from a personal/vendor CDN with few votes warrants medium concern.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 source_x86_64=("WorkBuddy-linux-x64-deb-${_pkgver}-${_build}.deb::https://download.codebuddy.cn/workbuddy/saas/linux-x64-deb/WorkBuddy-linux-x64-deb-${_pkgver}-${_build}.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt proprietary .deb binary from download.codebuddy.cn (a non-official, vendor-controlled host unrelated to any well-known project infrastructure) with no way to verify authenticity beyond a checksum; additionally bundles a prebuilt better-sqlite3 native module from npmjs.org with a fixed checksum, which is acceptable but the combination of a closed-source Electron app from a personal/vendor CDN with few votes warrants medium concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: lzsnyy <710080675@qq.com>
    
      2
    
      3pkgname=workbuddy-agent
    
      4_pkgver=5.6.2.40046327
    
      5_build=c7b525f3
    
      6pkgver=${_pkgver}_${_build}
    
      7pkgrel=1
    
      8pkgdesc="腾讯云代码助手推出的 AI Agent 办公工具"
    
      9arch=('x86_64' 'aarch64')
    
      10url="https://www.workbuddy.cn/app"
    
      11license=('custom')
    
      12depends=('gtk3' 'nss' 'alsa-lib' 'libcups' 'libdrm' 'libx11' 'libxcb'
    
      13         'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxi'
    
      14         'libxkbcommon' 'libxrandr' 'mesa' 'libsecret' 'libappindicator'
    
      15         'libpulse' 'libnotify' 'json-glib' 'wayland' 'systemd-libs' 'dbus')
    
      16optdepends=(
    
      17	'python-pip'
    
      18	'nodejs-lts: frontend skills'
    
      19	'imagemagick'
    
      20	'gnome-shell-extension-appindicator'
    
      21)
    
      22provides=()
    
      23conflicts=('workbuddy')
    
      24_registry="https://registry.npmjs.org"
    
      25source=(
    
      26  WorkBuddy.desktop
    
      27  "${_registry}/better-sqlite3/-/better-sqlite3-13.0.3.tgz"
    
      28)
    
      29sha256sums=('c093969b3d9b3a1828af23728144185ada452baaf706020aa179d5f4d5dd6b8c'
    
      30            '77e0513dc1a469fb3bceec4c7fb5ad3f403109787eda05be047ec17fd56868cb')
    
      31source_x86_64=("WorkBuddy-linux-x64-deb-${_pkgver}-${_build}.deb::https://download.codebuddy.cn/workbuddy/saas/linux-x64-deb/WorkBuddy-linux-x64-deb-${_pkgver}-${_build}.deb")
    
      32source_aarch64=("WorkBuddy-linux-arm64-deb-${_pkgver}-${_build}.deb::https://download.codebuddy.cn/workbuddy/saas/linux-arm64-deb/WorkBuddy-linux-arm64-deb-${_pkgver}-${_build}.deb")
    
      33sha256sums_x86_64=('12149ad8c0cd748fd5062d8f62c7827d688d8095427ada99b1ae9e7019897523')
    
      34sha256sums_aarch64=('561822578435d382a06d0a0b079a4b157f68b588c9fe72d589e2a88b2fd155fa')
    
      35
    
      36options=(!strip !debug)
    
      37
    
      38prepare() {
    
      39    tar xf data.tar.xz
    
      40}
    
      41
    
      42package() {
    
      43    install -d ${pkgdir}/opt/WorkBuddy
    
      44    cp -a usr ${pkgdir}/
    
      45    install -m644 WorkBuddy.desktop ${pkgdir}/usr/share/applications/workbuddy.desktop
    
      46    cd opt/WorkBuddy
    
      47    cp -a * ${pkgdir}/opt/WorkBuddy/
    
      48    install -Dm 755 /dev/stdin "${pkgdir}/usr/bin/workbuddy" <<EOF
    
      49#!/usr/bin/bash
    
      50exec /opt/WorkBuddy/workbuddy "\$@"
    
      51EOF
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-03 12:09:28	Medium	3
2026-11-03 12:04:35	Medium	3