the AUR is user supported, no claims are made, but AURs are built off of short scripts called PKGBUILDs so it's easy to audit, you're gonna want to look for the line that links to a tar archive or git repository.