Function analyze_pkgbuild_security 

pub fn analyze_pkgbuild_security(
    package_name: &str,
    pkgbuild_text: &str,
) -> SandboxStaticAnalysis

What: Analyze unexecuted PKGBUILD text for deterministic threat-model signals.

Inputs:

• package_name: Caller-owned package label for the resulting report.
• pkgbuild_text: Raw PKGBUILD text; it is treated only as text.

Output:

• SandboxStaticAnalysis with stable rule findings, bounded evidence, and explicit limitations.

Details:

• Flags command substitution (SB001), download commands (SB002), privilege escalation (SB003), recursive forced removal (SB004), and dynamic evaluation (SB005).
• Does not execute a shell, source files, access the network, invoke an external scanner, or produce an aggregate score.
• It is not a complete Bash parser, so callers must review findings and the returned limitations before making security decisions.