[chongli]

Yeah, it seems pretty obvious to me that there's no reason pkg should be running as root just to fetch the list of vulnerable ports.