jankeesvw-omarchy-downloads safe static: medium → AI: safe

Static medium → AI refined safe — see AI Review below for why (e.g., mx-ctl executable)

jankeesvw/omarchy-downloads • 3a48310 • Scanned 8/25/2026, 1:12:48 PM

Changed since 3a48310…3a48310 (0 files, 0 commits)

Score

Findings

Files

Install — pinned to audited commit

Usual omarchy plugin add https://github.com/jankeesvw/omarchy-downloads.git --enable installs latest. This pins to the exact commit audited here (3a48310):

omarchy plugin add https://github.com/jankeesvw/omarchy-downloads.git --yes && \
  git -C ~/.config/omarchy/plugins/jankeesvw.downloads checkout 3a4831032fccc24173533f7adeda4bffb5dcb664 && \
  omarchy plugin enable jankeesvw.downloads # audited commit 3a48310

Unpinned (latest): omarchy plugin add https://github.com/jankeesvw/omarchy-downloads.git --enable

What this plugin does

Adds a download icon to the Omarchy bar with a badge counting files added in the last N minutes. Clicking opens a floating window listing recent downloads (fresh/all filter, age and size) where rows can be dragged via Wayland wl_data_device into browsers/chat apps or double-clicked to open, and right-clicking the bar icon opens the download folder.

AI Review

safe

Well-hardened downloads viewer with no shell execution, no network, and explicit hardening (PlainText, array-form execDetached, absolute-path guards, bounded FolderListModel). All flagged patterns are expected read-only folder enumeration and standard Quickshell IPC. No malicious or privilege-escalation behavior detected.

Model opencode-go/muse-spark-1.2-contributor • 8/25/2026, 1:12:48 PM

How it works — sequence

sequenceDiagram
    participant User
    participant Panel as Panel.qml
    participant Store as DownloadsStore.qml
    participant FLM as FolderListModel
    participant Window as FloatingWindow/ListView
    participant OS as OS (xdg-open / Wayland DnD)
    User->>Panel: shell.json settings (folder, freshMinutes)
    Panel->>Store: applySettings() -> configure() via Util.fileUrl(folder)
    Store->>FLM: scanFolder = folderUrl (StandardPaths.DownloadLocation default)
    FLM-->>Store: folderModel.count / get(i, fileName/fileUrl/fileModified)
    Store->>Store: tick()/rebuild() filter isPartial, cap maxScan 2000 / maxRows 200, compute freshCount
    Store-->>Panel: freshCount -> badge
    Store-->>Window: files, displayPath, fresh state
    User->>Panel: click bar button / IPC summon (jankeesvw.downloads)
    Panel->>Store: toggle()/show() <-> open sync (guarded)
    Store-->>Window: visible = open
    User->>Window: drag row (DownloadRow.qml Drag.Automatic text/uri-list)
    Window->>OS: Wayland start_drag
    User->>Window: double-click row / right-click bar
    Window->>OS: Quickshell.execDetached(["xdg-open", target]) if target[0]=="/"

Generated by AI from static findings + file context

Findings — AI refined (4)

DownloadsStore.qml:34StandardPathsmedium →info

benign

Default writableLocation(DownloadLocation) with override via configure(folder); read-only enumeration for user-visible list, bounded by maxScan/maxRows, no write or exec. Expected for a downloads viewer.

↳ property url folderUrl: StandardPaths.writableLocation(StandardPaths.DownloadLocation) -> readonly property string folderPath -> FolderListModel { folder: root.scanFolder }

ℹ Not an executable - resolves default download directory; later consumed only as FolderListModel folder and displayPath/xdg-open target

DownloadsStore.qml:224FolderListModelmedium →info

benign

Read-only directory listing via Qt.labs.folderlistmodel, showDirs false, Time-sorted newest-first, capped to 2000 entries scanned and 200 rows shown, coalesced tick and polling fallback to avoid UI-thread DoS. No shell or exec.

↳ FolderListModel { folder: root.scanFolder; showDirs: false; sortField: Time } + rebuild() { folderModel.get(i,"fileName"/"fileUrl"/"fileModified") } + if (String(root.scanFolder)==="" || folderModel.status !== Ready) return

ℹ Not an executable - pure file metadata enumeration; URLs percent-encoded from model and used only for display and drag mimeData

Panel.qml:29ipcTargetmedium →low

benign

Standard Quickshell Panel ipcTarget "jankeesvw.downloads" for summon/open/close; no custom IpcHandler parsing payloads. State sync is guarded both ways (onOpenedChanged if DownloadsStore.open !== root.opened and Connections onOpenChanged) preventing bounce/amplification.

↳ ipcTarget: "jankeesvw.downloads" + onOpenedChanged: if (DownloadsStore.open !== root.opened) DownloadsStore.open = root.opened + Connections { onOpenChanged() { if (DownloadsStore.open && !root.opened) root.open() else if (...) root.close() } }

ℹ No executable invoked via IPC; exposes only window visibility toggle, not command execution

Panel.qml:69Util.fileUrlmedium →low

benign

Converts bar setting `folder` string to file:// URL for DownloadsStore.folderUrl; setting comes from shell.json, not IPC. Later use is FolderListModel watch or array-form xdg-open with leading-slash guard, no shell quoting needed.

↳ Panel.qml:69 folder !== "" ? Util.fileUrl(folder) : undefined -> DownloadsStore.configure() -> root.folderUrl / scanFolder + DownloadsStore.qml:257 if (target.charAt(0)==="/") Quickshell.execDetached(["xdg-open", target])

ℹ xdg-open opens folder/file with system default handler (not arbitrary binary). Args sanitized: array-form execDetached (no bash -lc) and absolute-path check (charAt(0)==="/"), blocks option injection like "-foo"; DownloadRow double-click uses same guard

Process execution

Panel.qml:29IPC handler exposure — payload appears validated via conditional check (handler checks state before acting; review logic)

Network

No network calls — good.

Changed files

Changed Files (0)

No changes detected (first scan).

No obfuscation detected.

Details — hidden by default

Files opened (3) — FolderListModel, StandardPaths

Files Opened (3)

Severity	Category	Pattern	File	Line	Description	Snippet
medium	fileOps	StandardPaths	DownloadsStore.qml	34	Accesses system paths via StandardPaths	property url folderUrl: StandardPaths.writableLocation(StandardPaths.DownloadLocation)
medium	fileOps	FolderListModel	DownloadsStore.qml	224	Reads directory via FolderListModel	if (String(root.scanFolder) === "" \|\| folderModel.status !== FolderListModel.Ready) return
medium	fileOps	Util.fileUrl	Panel.qml	69	Resolves file URL	folder !== "" ? Util.fileUrl(folder) : undefined)

Expected imports (6) — normal for Omarchy plugins

These are expected Quickshell imports, not counted as risk.

Expected Imports (6)

Severity	Category	Pattern	File	Line	Description	Snippet
info	imports	import Quickshell	DownloadRow.qml	3	Expected Quickshell import — normal for Omarchy plugins (no risk)	import Quickshell
info	imports	import qs	DownloadRow.qml	4	Expected local module import — normal for Omarchy plugins (no risk)	import qs.Commons
info	imports	import Quickshell	DownloadsStore.qml	7	Expected Quickshell import — normal for Omarchy plugins (no risk)	import Quickshell
info	imports	import qs	DownloadsStore.qml	8	Expected local module import — normal for Omarchy plugins (no risk)	import qs.Commons
info	imports	import Quickshell	Panel.qml	2	Expected Quickshell import — normal for Omarchy plugins (no risk)	import Quickshell
info	imports	import qs	Panel.qml	3	Expected local module import — normal for Omarchy plugins (no risk)	import qs.Commons

Full file tree (4 files)

File Tree (4 files)

Path	Type	Lines	Size
DownloadRow.qml	qml	170	7045
DownloadsStore.qml	qml	481	18716
Panel.qml	qml	145	5895
manifest.json	json	24	608

Raw static findings (4) — table view

Risk-Relevant Findings (raw) (4)

Severity	Category	Pattern	File	Line	Description	Snippet
medium	fileOps	StandardPaths	DownloadsStore.qml	34	Accesses system paths via StandardPaths	property url folderUrl: StandardPaths.writableLocation(StandardPaths.DownloadLocation)
medium	fileOps	FolderListModel	DownloadsStore.qml	224	Reads directory via FolderListModel	if (String(root.scanFolder) === "" \|\| folderModel.status !== FolderListModel.Ready) return
medium	ipc	ipcTarget	Panel.qml	29	IPC handler exposure — payload appears validated via conditional check (handler checks state before acting; review logic)	ipcTarget: "jankeesvw.downloads"
medium	fileOps	Util.fileUrl	Panel.qml	69	Resolves file URL	folder !== "" ? Util.fileUrl(folder) : undefined)

Generated by omarchy-audit at 2026-08-25T11:12:48.624Z • Commit 3a48310 linked to GitHub for verification • Overview