NachoRodriguezM-omarchy-google-calendar-clock low static: high → AI: low

Static high → AI refined low — see AI Review below for why (e.g., mx-ctl executable)

NachoRodriguezM/omarchy-google-calendar-clock • 14cf448 • Scanned 8/25/2026, 1:15:32 PM

Changed since 14cf448…14cf448 (0 files, 0 commits)

Score

Findings

Files

Install — pinned to audited commit

Usual omarchy plugin add https://github.com/NachoRodriguezM/omarchy-google-calendar-clock.git --enable installs latest. This pins to the exact commit audited here (14cf448):

omarchy plugin add https://github.com/NachoRodriguezM/omarchy-google-calendar-clock.git --yes && \
  git -C ~/.config/omarchy/plugins/omarchy-google-calendar-clock checkout 14cf4489cc5dbb26871d9cd05acfa369da1f9dde && \
  omarchy plugin enable omarchy-google-calendar-clock # audited commit 14cf448

Unpinned (latest): omarchy plugin add https://github.com/NachoRodriguezM/omarchy-google-calendar-clock.git --enable

What this plugin does

Plugin replaces the bar clock with a configurable date/time label and calendar popup. The popup shows a 6-week month grid with ISO weeks, year/life progress bars, and a per-day agenda synced via local Caldir ICS cache with optional Google pull/push via OAuth (direct or hosted). Users can create/edit recurring local events, get 5-min reminders, and JOIN meeting links directly.

AI Review

low

Plugin is a local-first clock/calendar with confined IPC and helper-script execution; static flags are largely benign. Resolved URLs point to bundled Panel.qml and fixed allow-list scripts, IPC exposes only no-arg UI verbs, and openUrlExternally is user-click-gated to https meeting links.

Model opencode-go/muse-spark-1.2-contributor • 8/25/2026, 1:15:32 PM

How it works — sequence

sequenceDiagram
    participant User
    participant BarWidget
    participant Panel
    participant Helper as scripts/calendar-*
    participant Caldir as Caldir/ICS cache
    participant Google
    participant Browser
    User->>BarWidget: click clock
    BarWidget->>Panel: Loader source Qt.resolvedUrl("Panel.qml") / toggle()
    Panel->>Helper: helperPath("calendar-cache-read") via Process.command
    Helper->>Caldir: read local ICS/JSON
    Caldir-->>Panel: parseBridgeOutput() events/range
    Panel-->>User: render month grid + agenda
    User->>Panel: create/edit event + push
    Panel->>Helper: calendar-create / calendar-mutate / calendar-push
    Helper->>Google: authenticated sync (OAuth)
    User->>Panel: click JOIN
    Panel->>Browser: Qt.openUrlExternally(meetingLinks[0])

Generated by AI from static findings + file context

Findings — AI refined (5)

BarWidget.qml:121Util.fileUrlmedium →info

benign

Static local QML import via Loader source: Qt.resolvedUrl("Panel.qml") loads bundled panel UI, never used as Process command or external path; no user input.

↳ Loader { source: Qt.resolvedUrl("Panel.qml") } BarWidget.qml:121

ℹ Not an executable — internal QML component load only, no Process execution.

BarWidget.qml:129ipcTargethigh →low

benign

IpcHandler target "omarchy-google-calendar-clock" exposes 10 fixed-arity no-arg verbs (open/close/toggle/cycleFormat/refreshCalendar/calendarStatus); no payload parsing or validation needed, cannot inject args or execute arbitrary commands. Worst is local unprivileged UI spam.

↳ IpcHandler { target: "omarchy-google-calendar-clock"; function refresh():void; function cycleFormat():void; function calendarStatus():string { return panelLoader.item.calendarStatus() } } BarWidget.qml:129-145

ℹ Indirect: refreshCalendar() triggers calendar-cache-read via helperPath, but path is hardcoded allow-list, not IPC-controllable.

Panel.qml:23ipcTargethigh →low

benign

Panel declares ipcTarget with manageIpc:false — actual handler lives in BarWidget.qml:129; same low-risk no-arg verbs, no deserialization of external payload, intentionally disabled on panel side.

↳ Panel { ipcTarget: "omarchy-google-calendar-clock" manageIpc: false } Panel.qml:22-24; BarWidget handles IPC

ℹ No direct executable; duplicate declaration of same IPC target.

Panel.qml:203Util.fileUrlmedium →low

benign

helperPath() does Qt.resolvedUrl("scripts/"+name) but all callers pass hardcoded literals (calendar-cache-read, calendar-pull/push, calendar-create/mutate, etc.); name never from settings/IPC/event data, so no traversal/injection despite being used as Process.command[0].

↳ function helperPath(name){ var url=String(Qt.resolvedUrl("scripts/"+name)) } -> used as calendarProcess.command=[root.helperPath("calendar-cache-read")] Panel.qml:394; 10+ similar Process commands at 226,255,394,499,515,537,781,803,827,876,894

ℹ Resolves bundled Caldir wrapper scripts (calendar-* , setup/uninstall) that sync local ICS with Google. Args are sanitized: dates via Model.keyForDate, time HH:MM regex, repeat count 2-999, Util.shellQuote for terminal flows; scripts run as user with fixed argv array, not shell.

Panel.qml:2540Qt.openUrlExternallyhigh →low

benign

User-gated JOIN button calls Qt.openUrlExternally(agendaEvent.meetingLinks[0]) only on explicit click; meetingLinks are https?:// URLs extracted via CalendarModel.eventMeetingLinks from conference_url/location/description, priorizing meet.google.com/zoom.us etc; no auto-open and not IPC-triggerable.

↳ Button { visible: meetingLinks.length>0; onClicked: { Qt.openUrlExternally(agendaEvent.meetingLinks[0]); root.close() } } Panel.qml:2538-2542; URL_PATTERN=/https?:\/\/[^\s<>"']+/g CalendarModel.js:68

ℹ Opens https URL in system browser via Qt handler; regex blocks file://, javascript: schemes; phishing risk is social-engineering via calendar invite, not RCE.

Process execution

BarWidget.qml:129IPC handler exposure — no payload validation detected (handler may accept arbitrary IPC without checks)
Panel.qml:23IPC handler exposure — no payload validation detected (handler may accept arbitrary IPC without checks)

Network

Panel.qml:2540Opens external URL

Changed files

Changed Files (0)

No changes detected (first scan).

No obfuscation detected.

Details — hidden by default

Files opened (2) — FolderListModel, StandardPaths

Files Opened (2)

Severity	Category	Pattern	File	Line	Description	Snippet
medium	fileOps	Util.fileUrl	BarWidget.qml	121	Resolves file URL	source: Qt.resolvedUrl("Panel.qml")
medium	fileOps	Util.fileUrl	Panel.qml	203	Resolves file URL	var url = String(Qt.resolvedUrl("scripts/" + name))

Expected imports (4) — normal for Omarchy plugins

These are expected Quickshell imports, not counted as risk.

Expected Imports (4)

Severity	Category	Pattern	File	Line	Description	Snippet
info	imports	import Quickshell	BarWidget.qml	2	Expected Quickshell import — normal for Omarchy plugins (no risk)	import Quickshell
info	imports	import qs	BarWidget.qml	4	Expected local module import — normal for Omarchy plugins (no risk)	import qs.Commons
info	imports	import Quickshell	Panel.qml	3	Expected Quickshell import — normal for Omarchy plugins (no risk)	import Quickshell
info	imports	import qs	Panel.qml	5	Expected local module import — normal for Omarchy plugins (no risk)	import qs.Commons

Full file tree (6 files)

File Tree (6 files)

Path	Type	Lines	Size
BarWidget.qml	qml	187	6436
CalendarModel.js	js	153	5375
Model.js	js	297	10983
Panel.qml	qml	2863	113094
manifest.json	json	22	586
release-assets/v0.1.7.json	json	10	416

Raw static findings (5) — table view

Risk-Relevant Findings (raw) (5)

Severity	Category	Pattern	File	Line	Description	Snippet
medium	fileOps	Util.fileUrl	BarWidget.qml	121	Resolves file URL	source: Qt.resolvedUrl("Panel.qml")
high	ipc	ipcTarget	BarWidget.qml	129	IPC handler exposure — no payload validation detected (handler may accept arbitrary IPC without checks)	IpcHandler {
high	ipc	ipcTarget	Panel.qml	23	IPC handler exposure — no payload validation detected (handler may accept arbitrary IPC without checks)	ipcTarget: "omarchy-google-calendar-clock"
medium	fileOps	Util.fileUrl	Panel.qml	203	Resolves file URL	var url = String(Qt.resolvedUrl("scripts/" + name))
high	network	Qt.openUrlExternally	Panel.qml	2540	Opens external URL	Qt.openUrlExternally(agendaEvent.meetingLinks[0])

Generated by omarchy-audit at 2026-08-25T11:15:32.917Z • Commit 14cf448 linked to GitHub for verification • Overview