Some Quick Look casks trying to write to /Applications unnecessarily?

[liamjones]

Output of brew config

HOMEBREW_VERSION: 4.2.2
ORIGIN: https://github.com/Homebrew/brew
HEAD: 705d2564ddfb9c915ee9425dd9ed408bfac61005
Last commit: 4 days ago
Core tap JSON: 05 Jan 10:57 UTC
Core cask tap JSON: 05 Jan 10:57 UTC
HOMEBREW_PREFIX: /usr/local
HOMEBREW_CASK_OPTS: []
HOMEBREW_DISPLAY: /private/tmp/com.apple.launchd.NWscj5ZwBy/org.xquartz:0
HOMEBREW_EDITOR: ~/bin/codew.sh
HOMEBREW_GITHUB_API_TOKEN: set
HOMEBREW_MAKE_JOBS: 16
Homebrew Ruby: 3.1.4 => /usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby/3.1.4/bin/ruby
CPU: 16-core 64-bit kabylake
Clang: 15.0.0 build 1500
Git: 2.43.0 => /usr/local/bin/git
Curl: 8.4.0 => /usr/bin/curl
macOS: 14.2.1-x86_64
CLT: 15.1.0.0.1.1700200546
Xcode: 15.1 => /Applications/Xcode_15.1.app/Contents/Developer

Output of brew doctor

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some installed casks are deprecated or disabled.
You should find replacements for the following casks:
  quicklookapk

Description of issue

I think this is a bug in some QL casks' code but I'm looking for confirmation.

For security reasons, the main user accounts at our organisation are 'Standard' accounts, not 'Admin's. We have to su to an admin account first to get access to sudo.

This generally works fine with brew formula but not casks as they want to sudo to write to /Applications from the Standard account.

QuickLook plugins however go in ~/Library/QuickLook so don't need privilege escalation and work fine.

I can install qlcolorcode, quicklook-json, qlimagesize from a Standard account just fine. However, if I try and install qlmarkdown or qlvideo it wants to write to /Applications. I don't think they should need to. If I go to the latest download of qlmarkdown from GitHub directly: https://github.com/toland/qlmarkdown/releases/tag/v1.3.6 it doesn't contain any .app, just the .qlgenerator so I don't get why it needs access to /Applications?

Relevant casks

qlmarkdown, qlvideo