M4Marvin-omarchy-plugin-opencode-go low static: medium → AI: low

Static medium → AI refined low — see AI Review below for why (e.g., mx-ctl executable)

M4Marvin/omarchy-plugin-opencode-go • 3594b52 • Scanned 8/25/2026, 11:54:18 AM

First scan — all files are new

Score

Findings

Files

⚠ Possible obfuscation detected — review carefully

What this plugin does

Displays OpenCode Go quota (5h rolling, weekly, monthly) as progress bars with percent, dollar limit, reset countdown and behind/ahead pace indicator in the Omarchy bar. Clicking opens a details panel with recent 7-day token history and status. Data is refreshed automatically (default 300s) by running collector.sh which calls the OpenCode Go API and reads local token history from opencode.db.

AI Review

low

Plugin is a read-only usage monitor with no arbitrary command execution or unvalidated IPC; only notable privilege is periodic execution of its own bundled collector.sh (fixed args) to query OpenCode API and local SQLite. No malicious patterns found.

Model opencode-go/muse-spark-1.2-contributor • 8/25/2026, 11:54:18 AM

How it works — sequence

sequenceDiagram
    participant User
    participant Panel as Panel.qml
    participant Service as Service.qml
    participant Script as collector.sh
    participant API as opencode.ai/zen/go/v1/usage
    participant DB as ~/.local/share/opencode/opencode.db
    Timer->>Service: triggeredOnStart / every refreshIntervalSec
    User->>Panel: click / R key / RightClick
    Panel->>Service: refresh()
    Service->>Script: Process command ["bash", collectorScript]
    Script->>API: curl Bearer key from auth.json
    Script->>DB: sqlite3 -readonly query last 7d tokens
    Script-->>Service: JSON {status, rolling, weekly, monthly, recentDays}
    Service->>Service: Model.parseCollector() validate label=="Go"
    Service-->>Panel: account / recentDays / lastError / lastUpdated
    Panel-->>User: render bars, countdown, pace, token chart

Generated by AI from static findings + file context

Findings — AI refined (3)

Panel.qml:14ipcTargetmedium →info

benign

Registers standard Omarchy bar-widget IPC target local.opencode-go with no custom IpcHandler in plugin; base Panel only exposes open/toggle via qs.Commons - no payload parsing or unchecked state mutation found.

↳ Panel { moduleName: "local.opencode-go" ipcTarget: "local.opencode-go" } // No IpcHandler blocks in Panel.qml/Service.qml

ℹ No executable; standard widget registration for bar toggle/refresh, no arguments or external input handling

Panel.qml:77Util.fileUrlmedium →info

benign

Resolves bundled static asset opencode-go.svg used solely as Image source with MultiEffect colorization; never passed to Process, execDetached, or file write - benign resource resolution (also at line 162).

↳ Image { source: Qt.resolvedUrl("opencode-go.svg") } // Panel.qml:77 and 162, Image.source only

ℹ No executable - SVG icon for bar/panel display only; not executed, no arguments, no sanitization needed

Service.qml:15Util.fileUrlmedium →low

needs review

Resolves bundled collector.sh which IS executed, so severity is low not info; but command is fixed ["bash", root.collectorScript] with no user-controlled args and path pinned to plugin dir via Qt.resolvedUrl - no injection surface beyond intended behavior.

↳ readonly property string collectorScript: decodeURIComponent(String(Qt.resolvedUrl("collector.sh")).replace(/^file:\/\//, "")) // Service.qml:15 used at collector.command = ["bash", root.collectorScript] // Service.qml:31 with guard if (refreshing || collector.running) return

ℹ collector.sh is bundled bash that curls https://opencode.ai/zen/go/v1/usage with key from $OPENCODE_AUTH_JSON or ~/.local/share/opencode/auth.json and reads ~/.local/share/opencode/opencode.db readonly for 7-day totals; invoked with zero args, no user interpolation, cutoff computed locally

Process execution

Panel.qml:14IPC handler exposure — payload appears validated via conditional check (handler checks state before acting; review logic)

Network

No network calls — good.

Changed files

Changed Files (9)

Added — LICENSE
Added — Model.js
Added — Panel.qml
Added — README.md
Added — Service.qml
Added — collector.sh
Added — manifest.json
Added — opencode-go.svg
Added — preview.png

Commits (2)

3594b52 — Add preview screenshot by Marvin V Prakash on 2026-08-14T06:24:18+04:00
db02dd6 — OpenCode Go usage bar widget for Omarchy by Marvin V Prakash on 2026-08-14T06:12:44+04:00

Flag: Possible obfuscation detected!

2 obfuscation findings — review carefully before updating.

Obfuscation Check (2)

Type	Severity	File	Line	Snippet	Preview
binary	high	collector.sh	1	#!/usr/bin/env bash set -uo pipefail AUTH_JSON="${OPENCODE_AUTH_JSON:-$HOME/.local/share/opencode/auth.json}" URL=https:
minified	medium	manifest.json	1	{"schemaVersion":1,"id":"local.opencode-go","name":"OpenCode Go Usage","version":"1.0.0","author":"OpenCode community","

Details — hidden by default

Files opened (2) — FolderListModel, StandardPaths

Files Opened (2)

Severity	Category	Pattern	File	Line	Description	Snippet
medium	fileOps	Util.fileUrl	Panel.qml	77	Resolves file URL	source: Qt.resolvedUrl("opencode-go.svg")
medium	fileOps	Util.fileUrl	Service.qml	15	Resolves file URL	readonly property string collectorScript: decodeURIComponent(String(Qt.resolvedUrl("collector.sh")).replace(/^file:\/\//

Expected imports (3) — normal for Omarchy plugins

These are expected Quickshell imports, not counted as risk.

Expected Imports (3)

Severity	Category	Pattern	File	Line	Description	Snippet
info	imports	import Quickshell	Panel.qml	5	Expected Quickshell import — normal for Omarchy plugins (no risk)	import Quickshell
info	imports	import qs	Panel.qml	7	Expected local module import — normal for Omarchy plugins (no risk)	import qs.Commons
info	imports	import Quickshell	Service.qml	2	Expected Quickshell import — normal for Omarchy plugins (no risk)	import Quickshell

Full file tree (5 files)

File Tree (5 files)

Path	Type	Lines	Size
Model.js	js	155	4646
Panel.qml	qml	396	12531
Service.qml	qml	66	2147
collector.sh	other	33	1894
manifest.json	json	2	679

Raw static findings (3) — table view

Risk-Relevant Findings (raw) (3)

Severity	Category	Pattern	File	Line	Description	Snippet
medium	ipc	ipcTarget	Panel.qml	14	IPC handler exposure — payload appears validated via conditional check (handler checks state before acting; review logic)	ipcTarget: "local.opencode-go"
medium	fileOps	Util.fileUrl	Panel.qml	77	Resolves file URL	source: Qt.resolvedUrl("opencode-go.svg")
medium	fileOps	Util.fileUrl	Service.qml	15	Resolves file URL	readonly property string collectorScript: decodeURIComponent(String(Qt.resolvedUrl("collector.sh")).replace(/^file:\/\//

Generated by omarchy-audit at 2026-08-25T09:54:18.727Z • Commit 3594b52 linked to GitHub for verification • Overview