xclicker-bin

maintainer zoltanpinter · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD executes a sudo command on an unverified local file 'checker' during build, which could run arbitrary code with elevated privileges and has a skipped checksum, posing a supply-chain risk.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The PKGBUILD executes a sudo command on an unverified local file 'checker' during build, which could run arbitrary code with elevated privileges and has a skipped checksum, posing a supply-chain risk.

PKGBUILD

      1# Maintainer: robiot <me@robiot.dev>
    
      2
    
      3pkgname=xclicker-bin
    
      4pkgver=1.5.1
    
      5pkgrel=1
    
      6pkgdesc='A blazing fast gui autoclicker for linux'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://github.com/robiot/xclicker'
    
      9license=('GPL-3.0')
    
      10makedepends=('meson' 'libx11' 'libxi' 'libxtst' 'pkgconf')
    
      11depends=('gtk3')
    
      12sha512sums=('SKIP')
    
      13source=("${url}/archive/refs/tags/v${pkgver}.tar.gz" 'checker')
    
      14
    
      15build() {
    
      16  sudo "$srcdir/checker"
    
      17  cd xclicker-bin-$pkgver
    
      18
    
      19  make release
    
      20}
    
      21
    
      22package() {
    
      23  cd xclicker-bin-$pkgver
    
      24
    
      25  install -Dm 644 assets/icon.png ${pkgdir}/usr/share/icons/hicolor/256x256/apps/xclicker-bin.png
    
      26  install -Dm 755 build/release/src/xclicker-bin ${pkgdir}/usr/bin/xclicker-bin
    
      27  install -Dm 755 assets/xclicker.desktop ${pkgdir}/usr/share/applications/xclicker.desktop
    
      28}
    
      29
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 11:20:22	MEDIUM	2