At a glance

1 · What is claimed?

Only the report text below — no validator has restated it as checkable claims yet.

2 · What does it affect?

Not yet mapped to any requirement or component.

3 · Is it reproducible?

No validation has been run yet.

4 · What remains unclear?

• Not validated yet: no claims, no reproducer.

5 · What happens next?

Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

Hello,

I've noticed that the script [bin/omarchy-update-system-pkgs](https://github.com/basecamp/omarchy/blob/master/bin/omarchy-update-system-pkgs) uses the command` yay --Sua --noconfirm` to update AUR packages.

This could be a security risk if a user has installed AUR packages that are not part of the Omarchy repository, or if a PKGBUILD of an AUR package gets compromised (for example, by a malicious update upstream or a local modification). Because the command is run with --noconfirm, the user is not prompted to review any PKGBUILD changes, and potentially malicious code could be installed without any warning or intervention.

Possible solutions:

- Avoid using --noconfirm for AUR package updates, or
- Add a check to update only trusted/approved AUR packages, or
- Prompt the user to review PKGBUILD changes before proceeding.

Thanks and best regards!

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.