jankeesvw-omarchy-downloads safe static: medium → AI: safe

Static medium → AI refined safe — see AI Review below for why (e.g., mx-ctl executable)

jankeesvw/omarchy-downloads • 3a48310 • Scanned 8/25/2026, 11:43:25 AM

Changed since 3a48310…3a48310 (0 files, 0 commits)

Score

Findings

Files

What this plugin does

Shows recent downloads in the bar with a badge for files arriving within freshMinutes and a floating window listing the newest files. Users can filter fresh/all, see age/size/icon, drag rows via Wayland wl_data_device (text/uri-list) into other apps, double-click to open a file or right-click to open the folder via xdg-open.

AI Review

safe

Plugin is a well-hardened downloads viewer: all Text is PlainText, directory access is read-only and bounded with DoS mitigation, exec uses Quickshell.execDetached array form with absolute-path checks and no shell, and IPC only toggles visibility.

Model opencode-go/muse-spark-1.2-contributor • 8/25/2026, 11:43:25 AM

How it works — sequence

sequenceDiagram
    participant User
    participant Panel
    participant Store as DownloadsStore
    participant Model as FolderListModel
    participant FS as Downloads Folder
    User->>Panel: applySettings() folder via Util.fileUrl()
    Panel->>Store: configure(freshMinutes, folderUrl)
    Store->>Model: set scanFolder = folderUrl
    Model->>FS: read directory (Time sort, newest first)
    FS-->>Model: fileName/fileUrl/filePath/fileSize/fileModified
    Model-->>Store: onCount/onStatus Ready -> scheduleTick() -> rebuild() (maxScan 2000, maxRows 200)
    Store-->>Panel: freshCount -> badge, files -> FloatingWindow ListView
    User->>Store: drag row (Drag.Automatic text/uri-list) / double-click
    Store->>FS: Quickshell.execDetached(["xdg-open", target]) if target starts with "/"

Generated by AI from static findings + file context

Findings — AI refined (4)

DownloadsStore.qml:34StandardPathsmedium →info

benign

Default download folder via StandardPaths.writableLocation(DownloadLocation); read-only URL property, user-overridable via Panel settings, never executed or passed to shell.

↳ property url folderUrl: StandardPaths.writableLocation(StandardPaths.DownloadLocation) -> folderPath/folderUrl used as FolderListModel folder and xdg-open target

ℹ No executable; only defines default file:// URL for FolderListModel source

DownloadsStore.qml:224FolderListModelmedium →info

benign

Read-only directory listing of the downloads folder; bounded by maxScan=2000/maxRows=200, polling fallback over maxScan mitigates UI thread DoS, no shell or exec on filenames, all display is PlainText.

↳ FolderListModel { folder: root.scanFolder showDirs:false sortField: Time } tick() checks status===Ready before rebuild()

ℹ No executable; data flows only to UI model (fileName/url/path/size/modified) and drag mimeData

Panel.qml:29ipcTargetmedium →info

benign

IPC target jankeesvw.downloads exposes only base Panel open/close (shell summon) with guarded mirroring via onOpenedChanged/onOpenChanged; no custom command handler or payload parsing.

↳ ipcTarget: "jankeesvw.downloads" | onOpenedChanged: if(DownloadsStore.open!==root.opened) | Connections onOpenChanged: root.open()/close()

ℹ No executable or argument handling via IPC; only toggles DownloadsStore.open boolean

Panel.qml:69Util.fileUrlmedium →info

benign

Converts user-controlled shell.json folder string to file:// URL for DownloadsStore.folderUrl; not shell-interpolated, later consumed only as FolderListModel folder and via Quickshell.execDetached array form with leading-slash check.

↳ Util.fileUrl(folder) -> DownloadsStore.configure()-> root.folderUrl -> FolderListModel folder / Quickshell.execDetached(["xdg-open", target]) if target.charAt(0)==="/" at DownloadsStore.qml:258 and DownloadRow.qml:166

ℹ xdg-open via Quickshell.execDetached(["xdg-open", absolutePath]) - opens folder (DownloadsStore.openFolder) or file (DownloadRow onDoubleClicked); array exec prevents shell injection, slash guard prevents option injection (-foo), user-initiated only

Process execution

Panel.qml:29IPC handler exposure — payload appears validated via conditional check (handler checks state before acting; review logic)

Network

No network calls — good.

Changed files

Changed Files (0)

No changes detected (first scan).

No obfuscation detected.

Details — hidden by default

Files opened (3) — FolderListModel, StandardPaths

Files Opened (3)

Severity	Category	Pattern	File	Line	Description	Snippet
medium	fileOps	StandardPaths	DownloadsStore.qml	34	Accesses system paths via StandardPaths	property url folderUrl: StandardPaths.writableLocation(StandardPaths.DownloadLocation)
medium	fileOps	FolderListModel	DownloadsStore.qml	224	Reads directory via FolderListModel	if (String(root.scanFolder) === "" \|\| folderModel.status !== FolderListModel.Ready) return
medium	fileOps	Util.fileUrl	Panel.qml	69	Resolves file URL	folder !== "" ? Util.fileUrl(folder) : undefined)

Expected imports (6) — normal for Omarchy plugins

These are expected Quickshell imports, not counted as risk.

Expected Imports (6)

Severity	Category	Pattern	File	Line	Description	Snippet
info	imports	import Quickshell	DownloadRow.qml	3	Expected Quickshell import — normal for Omarchy plugins (no risk)	import Quickshell
info	imports	import qs	DownloadRow.qml	4	Expected local module import — normal for Omarchy plugins (no risk)	import qs.Commons
info	imports	import Quickshell	DownloadsStore.qml	7	Expected Quickshell import — normal for Omarchy plugins (no risk)	import Quickshell
info	imports	import qs	DownloadsStore.qml	8	Expected local module import — normal for Omarchy plugins (no risk)	import qs.Commons
info	imports	import Quickshell	Panel.qml	2	Expected Quickshell import — normal for Omarchy plugins (no risk)	import Quickshell
info	imports	import qs	Panel.qml	3	Expected local module import — normal for Omarchy plugins (no risk)	import qs.Commons

Full file tree (4 files)

File Tree (4 files)

Path	Type	Lines	Size
DownloadRow.qml	qml	170	7045
DownloadsStore.qml	qml	481	18716
Panel.qml	qml	145	5895
manifest.json	json	24	608

Raw static findings (4) — table view

Risk-Relevant Findings (raw) (4)

Severity	Category	Pattern	File	Line	Description	Snippet
medium	fileOps	StandardPaths	DownloadsStore.qml	34	Accesses system paths via StandardPaths	property url folderUrl: StandardPaths.writableLocation(StandardPaths.DownloadLocation)
medium	fileOps	FolderListModel	DownloadsStore.qml	224	Reads directory via FolderListModel	if (String(root.scanFolder) === "" \|\| folderModel.status !== FolderListModel.Ready) return
medium	ipc	ipcTarget	Panel.qml	29	IPC handler exposure — payload appears validated via conditional check (handler checks state before acting; review logic)	ipcTarget: "jankeesvw.downloads"
medium	fileOps	Util.fileUrl	Panel.qml	69	Resolves file URL	folder !== "" ? Util.fileUrl(folder) : undefined)

Generated by omarchy-audit at 2026-08-25T09:43:25.401Z • Commit 3a48310 linked to GitHub for verification • Overview