Static high → AI refined low — see AI Review below for why (e.g., mx-ctl executable)
NachoRodriguezM/omarchy-google-calendar-clock • 14cf448 • Scanned 8/25/2026, 12:18:22 PM
First scan — all files are new
Shows a clock in the bar (click to open month grid with ISO week numbers) and a calendar agenda below it. Events are stored locally in Caldir ICS files and synced to Google on explicit pull/push actions; users can create/edit/delete local events, view meeting links, and receive 5-minute desktop reminders.
Plugin is local-first calendar with safe IPC surface and bundled helper scripts; all Process invocations use fixed literals and validated args, and external URL opening is user-initiated https-only, leaving no arbitrary code or injection surface.
Model opencode-go/muse-spark-1.2-contributor • 8/25/2026, 12:18:22 PM
sequenceDiagram
participant User
participant BarWidget
participant Panel
participant Helper as HelperScript
participant Caldir as Caldir/Google
participant Browser
User->>BarWidget: click clock / IPC summon
BarWidget->>Panel: open() / Loader Panel.qml
Panel->>Helper: Process [helperPath("calendar-cache-read")]
Helper->>Caldir: read ~/.local/state/omarchy/calendar-cache.json
Caldir-->>Panel: events + range (JSON)
Panel-->>User: month grid + agenda dots
User->>Panel: click JOIN
Panel->>Browser: Qt.openUrlExternally(meetingLinks[0])
User->>Panel: Pull/Push click
Panel->>Helper: Process [helperPath("calendar-pull/push")]
Helper->>Caldir: caldir pull/push + cache-updateGenerated by AI from static findings + file context
Constant Qt.resolvedUrl("Panel.qml") used only as Loader source for internal QML panel; not an executable and not user-controlled.
IpcHandler target "omarchy-google-calendar-clock" exposes 9 fixed no-arg functions (refresh, cycleFormat, toggleWeekStart, open/close/show/hide/toggle, refreshCalendar, calendarStatus); no payload is parsed or forwarded to shell/Process, so arbitrary IPC cannot inject args.
Panel declares ipcTarget but immediately sets manageIpc: false, so it registers no handler; actual IPC is handled solely by BarWidget.qml IpcHandler.
helperPath() resolves bundled scripts/ binaries via Qt.resolvedUrl("scripts/"+name); value is always used as Process.command[0] but name is only ever hardcoded literals (calendar-*) not user IPC/settings, so no path injection.
Opens agendaEvent.meetingLinks[0] only on explicit JOIN button click; meetingLinks derived from CalendarModel.eventMeetingLinks which extracts only https?:// URLs via URL_PATTERN and prioritizes conference hosts, limiting to https.
No obfuscation detected.
| Severity | Category | Pattern | File | Line | Description | Snippet |
|---|---|---|---|---|---|---|
| medium | fileOps | Util.fileUrl | BarWidget.qml | 121 | Resolves file URL | source: Qt.resolvedUrl("Panel.qml") |
| medium | fileOps | Util.fileUrl | Panel.qml | 203 | Resolves file URL | var url = String(Qt.resolvedUrl("scripts/" + name)) |
These are expected Quickshell imports, not counted as risk.
| Severity | Category | Pattern | File | Line | Description | Snippet |
|---|---|---|---|---|---|---|
| info | imports | import Quickshell | BarWidget.qml | 2 | Expected Quickshell import — normal for Omarchy plugins (no risk) | import Quickshell |
| info | imports | import qs | BarWidget.qml | 4 | Expected local module import — normal for Omarchy plugins (no risk) | import qs.Commons |
| info | imports | import Quickshell | Panel.qml | 3 | Expected Quickshell import — normal for Omarchy plugins (no risk) | import Quickshell |
| info | imports | import qs | Panel.qml | 5 | Expected local module import — normal for Omarchy plugins (no risk) | import qs.Commons |
| Path | Type | Lines | Size |
|---|---|---|---|
| BarWidget.qml | qml | 187 | 6436 |
| CalendarModel.js | js | 153 | 5375 |
| Model.js | js | 297 | 10983 |
| Panel.qml | qml | 2863 | 113094 |
| manifest.json | json | 22 | 586 |
| release-assets/v0.1.7.json | json | 10 | 416 |
| Severity | Category | Pattern | File | Line | Description | Snippet |
|---|---|---|---|---|---|---|
| medium | fileOps | Util.fileUrl | BarWidget.qml | 121 | Resolves file URL | source: Qt.resolvedUrl("Panel.qml") |
| high | ipc | ipcTarget | BarWidget.qml | 129 | IPC handler exposure — no payload validation detected (handler may accept arbitrary IPC without checks) | IpcHandler { |
| high | ipc | ipcTarget | Panel.qml | 23 | IPC handler exposure — no payload validation detected (handler may accept arbitrary IPC without checks) | ipcTarget: "omarchy-google-calendar-clock" |
| medium | fileOps | Util.fileUrl | Panel.qml | 203 | Resolves file URL | var url = String(Qt.resolvedUrl("scripts/" + name)) |
| high | network | Qt.openUrlExternally | Panel.qml | 2540 | Opens external URL | Qt.openUrlExternally(agendaEvent.meetingLinks[0]) |
Generated by omarchy-audit at 2026-08-25T10:18:22.890Z • Commit 14cf448 linked to GitHub for verification • Overview