pkgcheck

a tool that uses ai to give you an idea if an aur package is safe to install

background

i recently started using arch and i think the aur is cool, but obv downloading random packages can be a bad idea

so i thought it would be a fun project to make a chrome extension that uses ai to do the manual "checking" that we are all supposed to do (but probably don't) before installing an aur package

how it works

pkgcheck is a browser extension that analyzes AUR packages using AI to determine their safety. When you navigate to an AUR package page, the extension:

1. extracts the package name from the URL
2. fetches the PKGBUILD, metadata, and comments from the AUR
3. runs a deterministic scan of the PKGBUILD for dangerous patterns (network-to-shell, eval, missing checksums, ...)
4. sends this data to a serverless API that analyzes the package using AI (Z.ai and OpenAI models via the Vercel AI Gateway)
5. generates a comprehensive security report and a user-friendly summary
6. displays the results in the extension popup, highlighting risk level, recommendations, key concerns, and scanner findings

if the scanner finds a high-severity pattern, the verdict is forced to high risk / avoid regardless of what the AI says. the extension caches analysis results locally, so you don't need to re-analyze packages you've already checked.

tech stack

extension

• wxt (chrome extension framework)
• react
• tailwindcss
• dexie (indexedDB wrapper for local caching)

api

• vercel (serverless, bun runtime)
• hono (lightweight web framework)
• ai-sdk (for working with Z.ai and OpenAI models via the Vercel AI Gateway)
• cheerio (for HTML parsing)

usage

1. set up the API:

   • clone the repo and navigate to the api directory
   • set your environment variables: AI_GATEWAY_API_KEY (Vercel AI Gateway) and API_KEY (the token the extension will use)
   • run locally with bun run dev (serves on port 3001), or deploy to Vercel with bun run deploy

2. install the extension:

   • navigate to the extension directory
   • create .env.production with WXT_API_URL=https://your-api-url/analyze pointing at your deployed API (in dev mode the extension targets http://localhost:3001/analyze automatically)
   • build the extension with bun run build
   • load the extension in your browser from the .output/chrome-mv3 folder

3. using pkgcheck:

   • navigate to any AUR package page (e.g., https://aur.archlinux.org/packages/package-name)
   • click on the pkgcheck extension icon
   • enter your API password/token when prompted (stored in memory only, cleared when the browser closes)
   • click "Analyze Package" to get a security assessment

the extension will show a color-coded risk level, recommendation, key points, and any top concerns about the package.