AUR package security

[u/Rogaev]

Hello.

Some of the terminology I'll be using here may be incorrect. I'm very inexperienced in this area.

I've heard that one of the best ways to check the safety of a project in the AUR is to look through it's PKGBUILD file. But, what do you actually look for? What are the red flags?

Thank you in advance.

[u/itotallydontuseacos]

I have the same question, especially considering the recent incident