gastonmira-omarchy-mx-master low static: low (AI confirms)

gastonmira/omarchy-mx-master • 6d9184a • Scanned 8/25/2026, 1:13:32 PM

Changed since 6d9184a…6d9184a (0 files, 0 commits)

Score

Findings

Files

Install — pinned to audited commit

Usual omarchy plugin add https://github.com/gastonmira/omarchy-mx-master.git --enable installs latest. This pins to the exact commit audited here (6d9184a):

omarchy plugin add https://github.com/gastonmira/omarchy-mx-master.git --yes && \
  git -C ~/.config/omarchy/plugins/mxmaster.panel checkout 6d9184ada0a17e2c71dacbe1889c2e255d5887c1 && \
  omarchy plugin enable mxmaster.panel # audited commit 6d9184a

Unpinned (latest): omarchy plugin add https://github.com/gastonmira/omarchy-mx-master.git --enable

What this plugin does

Bar widget and panel for a Bluetooth-paired Logitech MX Master 3S. Shows connection/battery/host and lets the user tune DPI, SmartShift threshold, scroll ratchet/invert/hi-res and reassign thumb/gesture buttons. All writes go to the mouse's onboard memory via Solaar, so they persist across reboots and travel with the mouse to its other paired hosts.

AI Review

low

Well-hardened bar widget that wraps bundled helpers (mx-ctl/mx-buttons → solaar) with strict caps, plain-text sanitization and safe bash positional parameters. No unauthenticated IPC or injection surface; only intentional local code execution is the user-typed Custom button command which is explicitly user-authorized.

Model opencode-go/muse-spark-1.2-contributor • 8/25/2026, 1:13:32 PM

How it works — sequence

sequenceDiagram
    participant User
    participant Panel as Panel.qml
    participant Ctl as mx-ctl (bash)
    participant Btn as mx-buttons (python)
    participant Solaar
    participant Mouse as MX Master 3S
    User->>Panel: open panel / toggle / drag slider
    Panel->>Ctl: Process bash -c 'MX_DEVICE="$1" "$0" status [--battery]' ctl deviceName
    Ctl->>Solaar: solaar config/show DEVICE
    Solaar->>Mouse: HID++ query
    Mouse-->>Solaar: settings + battery
    Solaar-->>Ctl: text output
    Ctl-->>Panel: key=value lines (capped, parseStatus)
    Panel-->>User: render battery/DPI/hosts (Model.plain/snapDpi)
    User->>Panel: set DPI / toggle / change-host
    Panel->>Ctl: Process bash -c 'MX_DEVICE="$1" "$0" set "$2" "$3"' ctl deviceName key value
    Ctl->>Solaar: solaar config DEVICE key value
    Solaar->>Mouse: write onboard memory
    User->>Panel: set button action (incl. Custom command)
    Panel->>Btn: Process bash -c 'MX_DEVICE="$1" "$0" set ...' buttonsCtl deviceName name action command
    Btn->>Solaar: solaar config divert-keys/reprogrammable-keys + regenerate ~/.config/solaar/rules.yaml (yaml_str escaped)
    Btn->>Solaar: restart daemon (SIGTERM + Popen hide)
    Note over Btn,Solaar: Later button press → Solaar Execute: [bash,-c, command]

Generated by AI from static findings + file context

Findings — AI refined (2)

Panel.qml:16ipcTargetmedium →info

benign

Registers bar-widget IPC name for Omarchy shell routing; no custom message handler or payload parsing is defined in Panel.qml (no onIpc/message handler), so static flag's assumed conditional validation does not apply – exposure is inherent to framework and benign here.

↳ Panel { moduleName: "mxmaster.panel" ipcTarget: "mxmaster.panel" }

Panel.qml:29Util.fileUrlmedium →low

needs review

Not just a path resolve – Qt.resolvedUrl("mx-ctl") (and line 88 "mx-buttons") locates bundled executables later run via Process command with safe bash -c 'MX_DEVICE="$1" "$0" ...' positional-arg pattern; args (deviceName, keys, snapped DPI) are quoted as "$1"/"$2"/"$3" and capped via Model.capInput/plain, so no shell injection despite being an exec sink.

↳ readonly property string ctl: String(Qt.resolvedUrl("mx-ctl")).replace("file://", "") // used as statusProc.command = ["bash","-c","MX_DEVICE=\"$1\" \"$0\" status --battery", root.ctl, root.deviceName] and writeProc/buttonSetProc/buttonsProc similarly with root.buttonsCtl

ℹ mx-ctl is bundled bash wrapper around `solaar config/show` that reads/writes MX Master settings (dpi, smart-shift, scroll modes, change-host) to the mouse's onboard memory and queries battery; mx-buttons is bundled Python helper that maps actions.json (gestures/remap/command/custom) to solaar divert-keys/reprogrammable-keys and rebuilds ~/.config/solaar/rules.yaml with yaml_str-escaped Execute:[bash,-c, command] rules – Custom kind intentionally runs user-typed shell command on button press (user-authorized local exec, truncated to 2048 chars)

Process execution

Panel.qml:16IPC handler exposure — payload appears validated via conditional check (handler checks state before acting; review logic)

Network

No network calls — good.

Changed files

Changed Files (0)

No changes detected (first scan).

No obfuscation detected.

Details — hidden by default

Files opened (1) — FolderListModel, StandardPaths

Files Opened (1)

Severity	Category	Pattern	File	Line	Description	Snippet
medium	fileOps	Util.fileUrl	Panel.qml	29	Resolves file URL	readonly property string ctl: String(Qt.resolvedUrl("mx-ctl")).replace("file://", "")

Expected imports (2) — normal for Omarchy plugins

These are expected Quickshell imports, not counted as risk.

Expected Imports (2)

Severity	Category	Pattern	File	Line	Description	Snippet
info	imports	import Quickshell	Panel.qml	2	Expected Quickshell import — normal for Omarchy plugins (no risk)	import Quickshell.Io
info	imports	import qs	Panel.qml	3	Expected local module import — normal for Omarchy plugins (no risk)	import qs.Commons

Full file tree (4 files)

File Tree (4 files)

Path	Type	Lines	Size
Model.js	js	161	5856
Panel.qml	qml	791	29452
actions.json	json	38	2677
manifest.json	json	70	1880

Raw static findings (2) — table view

Risk-Relevant Findings (raw) (2)

Severity	Category	Pattern	File	Line	Description	Snippet
medium	ipc	ipcTarget	Panel.qml	16	IPC handler exposure — payload appears validated via conditional check (handler checks state before acting; review logic)	ipcTarget: "mxmaster.panel"
medium	fileOps	Util.fileUrl	Panel.qml	29	Resolves file URL	readonly property string ctl: String(Qt.resolvedUrl("mx-ctl")).replace("file://", "")

Generated by omarchy-audit at 2026-08-25T11:13:32.673Z • Commit 6d9184a linked to GitHub for verification • Overview