Shelly also has static analysis for AUR packages that looks for all the common, shifty ways a pkgbuild might try to give you something bad.