mashaaaaaaaaaaa/safeyay

safeyay is a wrapper around yay, a popular helper for installing packages from the Arch User Repository, or AUR. AUR packages are built from community-submitted build scripts that can run arbitrary code on your machine, so before yay builds one, safeyay steps in and runs whichever of three optional review tools you have set up: ClamAV antivirus, a static scanner called ks-aur-scanner, and a configurable AI reviewer. Packages from the official Arch repositories are skipped entirely, since those come as signed, prebuilt packages and never execute an AUR build script. If ClamAV is installed, safeyay scans the package's files for known malware signatures first, and treats a detection as high confidence, refusing to continue immediately without running the other checks. If ks-aur-scanner is installed, it runs as an independent static scanner, and its findings are kept separate from what the AI reviewer sees, so the two make independent judgments. The AI reviewer, when configured, examines the build script itself along with related files such as install scripts, patches, shell scripts, and package manager lockfiles, checks who controls any remote patches being applied, and uses AUR and GitHub metadata to help establish where a package actually comes from. The README is upfront that AI review is an extra signal, not a guarantee, and that models can miss real problems or raise false alarms. You install it either as an Arch package built with makepkg, downloading a checksummed release, or as a per-user install with an included install script. An example configuration works with a local Ollama model. Once set up, you use safeyay exactly where you would normally type yay, and when any reviewer reports something suspicious, it prints the findings and asks whether to continue, defaulting to no. If none of the three review components are configured, safeyay explicitly warns that it is currently providing no security benefit.