M4Marvin-omarchy-plugin-opencode-go low static: medium → AI: low

Static medium → AI refined low — see AI Review below for why (e.g., mx-ctl executable)

M4Marvin/omarchy-plugin-opencode-go • 3594b52 • Scanned 8/25/2026, 1:14:13 PM

Changed since 3594b52…3594b52 (0 files, 0 commits)

Score

Findings

Files

⚠ Possible obfuscation detected — review carefully

Install — pinned to audited commit

Usual omarchy plugin add https://github.com/M4Marvin/omarchy-plugin-opencode-go.git --enable installs latest. This pins to the exact commit audited here (3594b52):

omarchy plugin add https://github.com/M4Marvin/omarchy-plugin-opencode-go.git --yes && \
  git -C ~/.config/omarchy/plugins/local.opencode-go checkout 3594b52ff2c66d97b3b9866fb771441f1b4c3b7f && \
  omarchy plugin enable local.opencode-go # audited commit 3594b52

Unpinned (latest): omarchy plugin add https://github.com/M4Marvin/omarchy-plugin-opencode-go.git --enable

What this plugin does

Adds a bar widget that shows OpenCode Go quota as a percentage and highlights when usage is behind pace. Clicking expands a panel with 5h/weekly/monthly limit bars, reset countdowns, and a 7-day token history chart fetched via a background collector.

AI Review

low

Plugin is a read-only usage dashboard with no IPC command parser, no dynamic code execution, and fixed bundled assets. The only executable is the bundled collector.sh run as ["bash", script] with no arguments; risk is limited to expected read of local auth.json/DB and HTTPS fetch to opencode.ai.

Model opencode-go/muse-spark-1.2-contributor • 8/25/2026, 1:14:13 PM

How it works — sequence

sequenceDiagram
    participant User
    participant Panel as Panel.qml
    participant Service as Service.qml
    participant Collector as collector.sh
    participant API as opencode.ai
    participant DB as opencode.db
    User->>Panel: click/right-click or timer
    Panel->>Service: refresh()
    Service->>Collector: Process command ["bash", collectorScript]
    Collector->>DB: sqlite3 -readonly query recent tokens
    Collector->>API: curl Bearer $key https://opencode.ai/zen/go/v1/usage
    Collector-->>Service: JSON {status, rolling/weekly/monthly, recentDays}
    Service->>Service: Model.parseCollector() validate
    Service-->>Panel: update account/recentDays display

Generated by AI from static findings + file context

Findings — AI refined (3)

Panel.qml:14ipcTargetmedium →info

benign

Standard Omarchy Panel registration; no custom IPC handler or payload parsing in this plugin - only base Panel methods (toggle/open/close) are exposed, so no command-injection surface.

↳ Panel { moduleName: "local.opencode-go" ipcTarget: "local.opencode-go" } // no onIpcMessage/handler defined

ℹ No executable - declarative IPC target identifier only

Panel.qml:77Util.fileUrlmedium →info

benign

Static bundled asset Qt.resolvedUrl("opencode-go.svg") used only as Image source with MultiEffect colorization; literal string, never concatenated or executed.

↳ Image { source: Qt.resolvedUrl("opencode-go.svg") } at Panel.qml:77 and Panel.qml:162

ℹ No executable - SVG image asset rendered in UI, not run as process

Service.qml:15Util.fileUrlmedium →low

benign

Resolves bundled collector.sh to an absolute path then executed as fixed command ["bash", root.collectorScript] at Service.qml:31. Path is a literal inside plugin bundle, no user input, no args to inject; execution is intentional and bounded.

↳ readonly property string collectorScript: decodeURIComponent(String(Qt.resolvedUrl("collector.sh")).replace(/^file:\/\//,"")) -> collector.command = ["bash", root.collectorScript]

ℹ collector.sh is the plugin's bundled collector: reads $HOME/.local/share/opencode/auth.json (jq .["opencode-go"].key), curl -m10 to https://opencode.ai/zen/go/v1/usage with Bearer token, and sqlite3 -readonly query on opencode.db for last 7 days tokens/cost; takes no arguments, no sanitization needed

Process execution

Panel.qml:14IPC handler exposure — payload appears validated via conditional check (handler checks state before acting; review logic)

Network

No network calls — good.

Changed files

Changed Files (0)

No changes detected (first scan).

Flag: Possible obfuscation detected!

2 obfuscation findings — review carefully before updating.

Obfuscation Check (2)

Type	Severity	File	Line	Snippet	Preview
binary	high	collector.sh	1	#!/usr/bin/env bash set -uo pipefail AUTH_JSON="${OPENCODE_AUTH_JSON:-$HOME/.local/share/opencode/auth.json}" URL=https:
minified	medium	manifest.json	1	{"schemaVersion":1,"id":"local.opencode-go","name":"OpenCode Go Usage","version":"1.0.0","author":"OpenCode community","

Details — hidden by default

Files opened (2) — FolderListModel, StandardPaths

Files Opened (2)

Severity	Category	Pattern	File	Line	Description	Snippet
medium	fileOps	Util.fileUrl	Panel.qml	77	Resolves file URL	source: Qt.resolvedUrl("opencode-go.svg")
medium	fileOps	Util.fileUrl	Service.qml	15	Resolves file URL	readonly property string collectorScript: decodeURIComponent(String(Qt.resolvedUrl("collector.sh")).replace(/^file:\/\//

Expected imports (3) — normal for Omarchy plugins

These are expected Quickshell imports, not counted as risk.

Expected Imports (3)

Severity	Category	Pattern	File	Line	Description	Snippet
info	imports	import Quickshell	Panel.qml	5	Expected Quickshell import — normal for Omarchy plugins (no risk)	import Quickshell
info	imports	import qs	Panel.qml	7	Expected local module import — normal for Omarchy plugins (no risk)	import qs.Commons
info	imports	import Quickshell	Service.qml	2	Expected Quickshell import — normal for Omarchy plugins (no risk)	import Quickshell

Full file tree (5 files)

File Tree (5 files)

Path	Type	Lines	Size
Model.js	js	155	4646
Panel.qml	qml	396	12531
Service.qml	qml	66	2147
collector.sh	other	33	1894
manifest.json	json	2	679

Raw static findings (3) — table view

Risk-Relevant Findings (raw) (3)

Severity	Category	Pattern	File	Line	Description	Snippet
medium	ipc	ipcTarget	Panel.qml	14	IPC handler exposure — payload appears validated via conditional check (handler checks state before acting; review logic)	ipcTarget: "local.opencode-go"
medium	fileOps	Util.fileUrl	Panel.qml	77	Resolves file URL	source: Qt.resolvedUrl("opencode-go.svg")
medium	fileOps	Util.fileUrl	Service.qml	15	Resolves file URL	readonly property string collectorScript: decodeURIComponent(String(Qt.resolvedUrl("collector.sh")).replace(/^file:\/\//

Generated by omarchy-audit at 2026-08-25T11:14:13.691Z • Commit 3594b52 linked to GitHub for verification • Overview