Yeah. There’s also some others behaviours to look at.
Like, does the PKGBUILD install the package on some non-standard location?
That’s a suspicious behaviour, although it’s not an automatic red flag by itself.
Does it execute arbitrary code or any external script (worse if it’s Python, Lua or JS)?
That’s a HUGE red flag in most of cases.
Does it (ab)uses of AWK, sed and the like? That’s also suspicious in a variety of cases.
Yeah. There’s also some others behaviours to look at.
Like, does the PKGBUILD install the package on some non-standard location? That’s a suspicious behaviour, although it’s not an automatic red flag by itself.
Does it execute arbitrary code or any external script (worse if it’s Python, Lua or JS)? That’s a HUGE red flag in most of cases.
Does it (ab)uses of AWK, sed and the like? That’s also suspicious in a variety of cases.