← Back to overview

gastonmira-omarchy-mx-master low static: low (AI confirms)

gastonmira/omarchy-mx-master • 6d9184a • Scanned 8/25/2026, 11:42:49 AM

Changed since 6d9184a…6d9184a (0 files, 0 commits)

Score
4
Findings
2
Files
4

What this plugin does

Shows battery, connection state and live settings for a Logitech MX Master 3S in the Omarchy bar and lets the user adjust DPI, scroll-wheel modes and SmartShift threshold. It also remaps the divertable mouse buttons to presets or custom shell commands that run via Solaar rules, writing changes to the mouse's onboard memory so they persist across reboots and hosts.

AI Review

low

Plugin is a legitimate system widget with careful input caps, output truncation, and shell escaping; IPC exposure is inert and bundled executables are invoked via positional parameters with no unsanitized injection path. Main privilege is intended: writing mouse settings and Solaar rules and restarting Solaar.

Model opencode-go/muse-spark-1.2-contributor • 8/25/2026, 11:42:49 AM

How it works — sequence

sequenceDiagram
    participant User
    participant Panel
    participant Ctl as mx-ctl
    participant Btn as mx-buttons
    participant Solaar
    participant Mouse
    User->>Panel: open panel / move slider / pick button action
    Panel->>Ctl: Process bash -c MX_DEVICE="$1" "$0" status/set (ctl, deviceName)
    Ctl->>Solaar: solaar config/show "$DEVICE" (timeout 15s, head -c 64k)
    Solaar->>Mouse: HID++ over Bluetooth/hidraw
    Mouse-->>Solaar: settings / Battery
    Solaar-->>Ctl: key=value lines
    Ctl-->>Panel: stdout -> Model.parseStatus/capInput
    Panel->>Btn: get / set button (mx-buttons get/set)
    Btn->>Solaar: solaar config divert-keys / reprogrammable-keys
    Btn->>Solaar: write ~/.config/solaar/rules.yaml (yaml_str escaped) + SIGTERM/restart

Generated by AI from static findings + file context

Findings — AI refined (2)

Panel.qml:16ipcTargetmedium →info
benign

Sets ipcTarget but defines no IpcHandler/onMessage; no custom payload handler exists to validate or exploit, only base Panel lifecycle is exposed.

↳ Panel { moduleName: "mxmaster.panel" ipcTarget: "mxmaster.panel" } - no IpcHandler found in file
Panel.qml:29Util.fileUrlmedium →low
benign

Qt.resolvedUrl("mx-ctl") (and "mx-buttons" at line 88) locates bundled helpers, not arbitrary files; both are later executed via Process bash -c with positional params ($0=ctl, $1=deviceName) and quoted MX_DEVICE="$1", preventing injection.

↳ readonly property string ctl: String(Qt.resolvedUrl("mx-ctl")).replace("file://", "") -> statusProc.command = ["bash","-c","MX_DEVICE=\"$1\" \"$0\" status --battery", root.ctl, root.deviceName] (102-104) ; writeProc.command similarly (144)
ℹ mx-ctl wraps `solaar config/show` for Logitech MX Master 3S (status/battery/set, writes to mouse onboard memory); mx-buttons wraps `solaar config divert-keys/reprogrammable-keys` and regenerates ~/.config/solaar/rules.yaml with Execute: [bash,-c,command] ; args sanitized via bash positional parameters, quoted assignments, timeout/head -c caps, and yaml_str escaping; custom command via panel TextField is capped to 2048 chars and intentional user-controlled Execute.

Process execution

  • Panel.qml:16IPC handler exposure — payload appears validated via conditional check (handler checks state before acting; review logic)

Network

No network calls — good.

Changed files

Changed Files (0)

No changes detected (first scan).

No obfuscation detected.

Details — hidden by default

Files opened (1) — FolderListModel, StandardPaths

Files Opened (1)

Severity Category Pattern File Line Description Snippet
medium fileOps Util.fileUrl Panel.qml 29 Resolves file URL readonly property string ctl: String(Qt.resolvedUrl("mx-ctl")).replace("file://", "")
Expected imports (2) — normal for Omarchy plugins

These are expected Quickshell imports, not counted as risk.

Expected Imports (2)

Severity Category Pattern File Line Description Snippet
info imports import Quickshell Panel.qml 2 Expected Quickshell import — normal for Omarchy plugins (no risk) import Quickshell.Io
info imports import qs Panel.qml 3 Expected local module import — normal for Omarchy plugins (no risk) import qs.Commons
Full file tree (4 files)

File Tree (4 files)

PathTypeLinesSize
Model.js js 161 5856
Panel.qml qml 791 29452
actions.json json 38 2677
manifest.json json 70 1880
Raw static findings (2) — table view

Risk-Relevant Findings (raw) (2)

Severity Category Pattern File Line Description Snippet
medium ipc ipcTarget Panel.qml 16 IPC handler exposure — payload appears validated via conditional check (handler checks state before acting; review logic) ipcTarget: "mxmaster.panel"
medium fileOps Util.fileUrl Panel.qml 29 Resolves file URL readonly property string ctl: String(Qt.resolvedUrl("mx-ctl")).replace("file://", "")

Generated by omarchy-audit at 2026-08-25T09:42:49.184Z • Commit 6d9184a linked to GitHub for verification • Overview