{"id":31165305,"url":"https://github.com/mgalgs/aur-sleuth","last_synced_at":"2025-09-19T08:06:53.262Z","repository":{"id":307964728,"uuid":"1031204338","full_name":"mgalgs/aur-sleuth","owner":"mgalgs","description":"An LLM-powered security auditing tool for Arch User Repository (AUR) packages with yay integration.","archived":false,"fork":false,"pushed_at":"2025-09-12T20:43:47.000Z","size":903,"stargazers_count":5,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2025-09-12T22:53:13.020Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mgalgs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-08-03T08:37:05.000Z","updated_at":"2025-09-12T20:43:51.000Z","dependencies_parsed_at":"2025-09-12T22:19:59.069Z","dependency_job_id":"9ca7ea4f-4a65-4912-89d9-264c568fd260","html_url":"https://github.com/mgalgs/aur-sleuth","commit_stats":null,"previous_names":["mgalgs/aur-sleuth"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/mgalgs/aur-sleuth","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mgalgs%2Faur-sleuth","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mgalgs%2Faur-sleuth/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mgalgs%2Faur-sleuth/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mgalgs%2Faur-sleuth/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mgalgs","download_url":"https://codeload.github.com/mgalgs/aur-sleuth/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mgalgs%2Faur-sleuth/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":275902524,"owners_count":25549245,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-19T02:00:09.700Z","response_time":108,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-09-19T08:06:50.709Z","updated_at":"2025-09-19T08:06:53.247Z","avatar_url":"https://github.com/mgalgs.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# aur-sleuth\n\nAn LLM-powered security auditing tool for Arch User Repository (AUR) packages.\n\n`aur-sleuth` performs in-depth security analysis of an AUR package either as a\nstandalone tool, or as a `makepkg` wrapper:\n\n```bash\n# Audit a package from the AUR without building or installing\naur-sleuth package-name\n\n# Audit a package then build and install with yay if it passes the audit\nyay --makepkg makepkg-sleuthed package-name\n\n# Audit, then build and install a local package (in a directory containing a PKGBUILD)\nmakepkg-sleuthed -si\n```\n\n## Demo\n\nHere it is in action catching the shenanigans from the infamous [malicious `google-chrome-stable` package](https://www.reddit.com/r/archlinux/comments/1me632m/is_this_another_aur_infect_package/):\n\n![Screencast](./demo.gif)\n\n## Motivation\n\nRecently, there have been subtly malicious packages uploaded to the AUR. This tool\nhelps detect such issues by using an LLM to analyze AUR packages for potential\nsecurity concerns before building.\n\n`aur-sleuth` performs a security audit of all of the files in the `source` array in\nthe `PKGBUILD`, along with any other files from the actual package sources that the\nsecurity auditing LLM deems interesting.\n\nThis helps fulfill one of the great promises of open source software: security\nthrough the ability to audit the source code of applications you run on your\nmachine. In the past this wasn't really practical since there's just too much code to\nreview. But in a world with readily available LLMs that are fast, cheap, and\neffective, this promise of enhanced security becomes extremely compelling. As LLMs\nget even faster and cheaper there will be no reason not to audit every bit of code\nyou run on your machine. This will only be possible in the world of open source!\n\n## Security Considerations\n\n- This tool is meant to *assist* in security auditing, not replace good judgment\n- Always review code before installing packages from AUR\n- The LLM analysis is not foolproof and may produce false positives or negatives\n- Keep your API keys secure and monitor usage\n\n## Installation\n\n*(AUR package coming soon...)*\n\n1. Install dependencies:\n   ```bash\n   sudo pacman -S uv\n   ```\n\n2. Clone this repository:\n   ```bash\n   git clone https://github.com/mgalgs/aur-sleuth.git\n   cd aur-sleuth\n   ```\n\n3. Install the script.\n\n   **System-wide installation (requires sudo):**\n   ```bash\n   sudo make install\n   ```\n   This will install `aur-sleuth` and a symlink `makepkg-sleuthed` to `/usr/local/bin`.\n\n   **User-local installation (no sudo required):**\n   ```bash\n   make install PREFIX=$HOME/.local\n   ```\n   This will install the scripts to `$HOME/.local/bin`. Make sure this directory is in your `PATH`.\n\nAlternatively you can simply download [`aur-sleuth`](https://raw.githubusercontent.com/mgalgs/aur-sleuth/refs/heads/master/aur-sleuth), drop it in your PATH, and add a symlink named `makepkg-sleuthed`.\n\n## Configuration\n\nThe tool can be configured with environment variables:\n\n- `OPENAI_API_KEY`: Your API key. This is required.\n- `OPENAI_BASE_URL`: The API endpoint. Defaults to OpenRouter if not set.\n- `OPENAI_MODEL`: The model to use. Defaults to `qwen/qwen3-235b-a22b-2507`.\n- `MAX_LLM_JOBS`: Max concurrent LLM calls. Defaults to `3`.\n- `NUM_FILES_TO_REVIEW`: The number of files to review in addition to those listed in\n  the `source` array. Defaults to `10`.\n- `LLM_TEMPERATURE`: The temperature parameter for the LLM (0.0-2.0). If not set, uses model default.\n- `LLM_TOP_P`: The top-p parameter for the LLM (0.0-1.0). If not set, uses model default.\n\nYou can either set these environment variables directly in your shell, or add them to\na configuration file. The tool will automatically load configuration from\n`/etc/aur-sleuth.conf` (system-wide) or `~/.config/aur-sleuth.conf` (user-specific),\nwith user-specific configuration taking precedence.\n\nThe configuration file should be in INI format:\n\n```ini\n[default]\nOPENAI_API_KEY = your-api-key\nOPENAI_BASE_URL = your-base-url\nOPENAI_MODEL = your-model\nMAX_LLM_JOBS = desired-concurrency\nLLM_TEMPERATURE = 0.7  # Omit to use the model default\nLLM_TOP_P = 0.9        # ditto\n```\n\n### Example using OpenRouter\n\n```ini\n[default]\nOPENAI_API_KEY = sk-or-v1-7f8...194\nOPENAI_BASE_URL = https://openrouter.ai/api/v1\nOPENAI_MODEL = qwen/qwen3-30b-a3b-instruct-2507\nMAX_LLM_JOBS = 10\n```\n\n### Example using OpenAI\n\n```ini\n[default]\nOPENAI_API_KEY = sk-proj-EW...KA\nOPENAI_BASE_URL = https://api.openai.com/v1\nOPENAI_MODEL = gpt-5-mini\nMAX_LLM_JOBS = 5\n```\n\n### Example using local ollama instance\n\n```ini\n[default]\nOPENAI_API_KEY = ollama\nOPENAI_BASE_URL = http://localhost:11434/v1\nOPENAI_MODEL = llama3.1:8b\nMAX_LLM_JOBS = 1\n```\n\n## Usage\n\n### 1. `aur-sleuth` (Standalone Audit)\n\nPerforms an agentic security audit on the package contents. It does not build the\npackage.\n\n**Usage:**\n```bash\nusage: aur-sleuth [-h] [--clone-url CLONE_URL] [--output OUTPUT] [--model MODEL] [--base-url BASE_URL] [--max-llm-jobs MAX_LLM_JOBS] [--num-files-to-review NUM_FILES_TO_REVIEW] package_name\n\nRun a security audit on an AUR package.\n\npositional arguments:\n  package_name          Name of the AUR package.\n\noptions:\n  -h, --help            show this help message and exit\n  --clone-url CLONE_URL\n                        Optional custom clone URL for the AUR package. Defaults to https://aur.archlinux.org/{package_name}.git.\n  --output OUTPUT       Output format. Supported formats: rich, plain. Defaults to rich.\n  --model MODEL         LLM to use (overrides environment and config file settings)\n  --base-url BASE_URL   Base API URL (OpenAI API compatible) to use (overrides environment and config file settings)\n  --max-llm-jobs MAX_LLM_JOBS, -j MAX_LLM_JOBS\n                        Maximum number of concurrent LLM audit jobs (default: 3)\n  --num-files-to-review NUM_FILES_TO_REVIEW, -n NUM_FILES_TO_REVIEW\n                        Target number of files to audit jobs (default: 10)\n```\n\nThe audit process is subject to a session token limit (default: 100,000 tokens) to manage API usage.\n\n**Examples:**\n\n- **Audit a package:**\n  ```bash\n  aur-sleuth google-chrome-stable\n  ```\n\n- **Audit with custom clone URL:**\n  ```bash\n  aur-sleuth --clone-url https://example.com/repo.git package-name\n  ```\n\n- **Use plain text output:**\n  ```bash\n  aur-sleuth --output plain package-name\n  ```\n\nAfter the audit completes, if it is deemed safe, the tool will print the\npath to the temporary directory. You can then inspect the files and, if you\nchoose to proceed, run `makepkg` manually from within that directory.\n\n### 2. `makepkg-sleuthed` (Wrapper Mode)\n\nThis mode is for integrating the audit into your existing `makepkg`\nworkflow, for example with a AUR helper like `yay`.\n\n**With `yay`:**\n\nAudit a package, then install if it passes:\n\n```bash\nyay --makepkg makepkg-sleuthed package-name\n```\n\nYou can persist the `--makepkg` setting like so:\n\n```bash\nyay --makepkg makepkg-sleuthed --save\n```\n\nThen you no longer have to pass `--makepkg` to each invocation of `yay`. Just use it\nas you normally would and the audit will be performed automatically:\n\n```bash\nyay -S package-name\n```\n\n**Direct Usage:**\n\nYou can also invoke the wrapper directly in place of `makepkg`. Just pass `makepkg`\narguments to it:\n\n```bash\n# In a directory with a PKGBUILD\nmakepkg-sleuthed -si\n```\n\nThe wrapper will automatically skip the audit for certain makepkg operations like\n`--verifysource`, `--nobuild`, `--geninteg`, `-o`, and `-g`.\n\n## How it works\n\nThe script checks how it was invoked (`sys.argv[0]`).\n1.  **`aur-sleuth`:** It runs the in-depth audit on the specified package.\n2.  **`makepkg-sleuthed`:** It acts as a wrapper around `makepkg`, performing the\n    audit as if invoked via `aur-sleuth`, and then handing off execution to `makepkg`\n    for building.\n\n## Supported LLM Providers\n\nAny OpenAI-compatible API server\n\n## Contributing\n\nContributions are welcome! Please feel free to submit issues or pull requests.\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmgalgs%2Faur-sleuth","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmgalgs%2Faur-sleuth","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmgalgs%2Faur-sleuth/lists"}