← Back to overview

niraletter-vitals low static: low (AI confirms)

niraletter/vitals • 1dcdbf7 • Scanned 8/25/2026, 11:55:14 AM

First scan — all files are new

Score
2
Findings
1
Files
8

What this plugin does

Vitals adds a bar widget showing one pinned metric (CPU, memory, network, disk, GPU or storage) and a dashboard popup with six live tiles, sparkline graphs and expandable details. When open it polls /proc, sensors, lspci and nvidia-smi/intel_gpu_top to populate per-core CPU, memory pressure, network/disk rates, GPU VRAM/temperature and a searchable, sortable process list with terminate/force-kill.

AI Review

low

Single flagged Qt.resolvedUrl is a benign local QML loader with no exec; plugin is a legitimate system monitor that polls hardcoded /proc/sys tools and only runs privileged actions (kill, pkexec) after explicit user confirmation and strict validation (PID>1, currentUser-scoped fdinfo).

Model opencode-go/muse-spark-1.2-contributor • 8/25/2026, 11:55:14 AM

How it works — sequence

sequenceDiagram
    participant User
    participant BarWidget
    participant Panel
    participant Sys as System Tools
    User->>BarWidget: Click / middle-click widget
    BarWidget->>Panel: Loader source Qt.resolvedUrl("Panel.qml")
    Panel->>Sys: Poll cat /proc/stat, /proc/meminfo, /proc/net/dev, df, sensors -j, lspci, nvidia-smi
    Sys-->>Panel: stdout parsed -> cpu/memory/network/disk/gpu/mounts state
    Panel-->>User: Render tiles, graphs, tooltip and process list
    User->>Panel: Expand tile / filter/search / select PID -> Terminate/Force kill
    Panel->>Panel: ConfirmDialog check pid>1
    Panel->>Sys: kill -TERM/-KILL <pid> or pkexec setcap/pacman for intel_gpu_top
    Sys-->>Panel: exitCode -> actionMessage + refreshFull()

Generated by AI from static findings + file context

Findings — AI refined (1)

BarWidget.qml:61Util.fileUrlmedium →info
benign

Qt.resolvedUrl('Panel.qml') is a static local QML import used as Loader.source for UI composition; no user input, no filesystem traversal, and never passed to Process.command or shell execution.

↳ Loader { source: Qt.resolvedUrl("Panel.qml") } at BarWidget.qml:61 -> onLoaded injectPanel(); used only as QML component source, not as executable
ℹ None - resolves sibling UI file Panel.qml inside plugin bundle, not an executable. No args, no execDetached, no Process invocation.

Process execution

No process execution detected — good.

Network

No network calls — good.

Changed files

Changed Files (11)

  • Added — BarWidget.qml
  • Added — GpuLogic.js
  • Added — LICENSE
  • Added — MetricTiles.qml
  • Added — Model.js
  • Added — Panel.qml
  • Added — ProcessList.qml
  • Added — ProcessLogic.js
  • Added — README.md
  • Added — manifest.json
  • Added — preview.png

Commits (10)

  • 1dcdbf7 — make the text more visible across all themes by Nirakar Bogati on 2026-08-15T18:35:23+05:45
  • 03718a1 — Delete image.jpeg by N1R4 on 2026-08-13T02:11:56+05:45
  • 02002cc — add image preview by N1R4 on 2026-08-13T02:11:40+05:45
  • 08f8eda — Fix formatting in README installation instructions by N1R4 on 2026-08-13T00:55:02+05:45
  • 6989b5a — update README by N1R4 on 2026-08-13T00:54:03+05:45
  • 8e0c73f — update README by N1R4 on 2026-08-13T00:53:10+05:45
  • b5c0584 — Remove Development section from README by N1R4 on 2026-08-13T00:52:08+05:45
  • f7e128b — Reorganize README: move Installation before Features and clean up by N1R4 on 2026-08-13T00:48:57+05:45
  • 41ae7bf — Update README.md by N1R4 on 2026-08-13T00:47:19+05:45
  • b368eab — update README by N1R4 on 2026-08-13T00:46:14+05:45

No obfuscation detected.

Details — hidden by default

Files opened (1) — FolderListModel, StandardPaths

Files Opened (1)

Severity Category Pattern File Line Description Snippet
medium fileOps Util.fileUrl BarWidget.qml 61 Resolves file URL source: Qt.resolvedUrl("Panel.qml")
Expected imports (6) — normal for Omarchy plugins

These are expected Quickshell imports, not counted as risk.

Expected Imports (6)

Severity Category Pattern File Line Description Snippet
info imports import qs BarWidget.qml 2 Expected local module import — normal for Omarchy plugins (no risk) import qs.Commons
info imports import qs MetricTiles.qml 4 Expected local module import — normal for Omarchy plugins (no risk) import qs.Commons
info imports import Quickshell Panel.qml 4 Expected Quickshell import — normal for Omarchy plugins (no risk) import Quickshell
info imports import qs Panel.qml 6 Expected local module import — normal for Omarchy plugins (no risk) import qs.Commons
info imports import Quickshell ProcessList.qml 4 Expected Quickshell import — normal for Omarchy plugins (no risk) import Quickshell
info imports import qs ProcessList.qml 5 Expected local module import — normal for Omarchy plugins (no risk) import qs.Commons
Full file tree (8 files)

File Tree (8 files)

PathTypeLinesSize
BarWidget.qml qml 98 2471
GpuLogic.js js 94 3066
MetricTiles.qml qml 741 33433
Model.js js 33 852
Panel.qml qml 3061 111007
ProcessList.qml qml 488 18965
ProcessLogic.js js 67 2849
manifest.json json 20 481
Raw static findings (1) — table view

Risk-Relevant Findings (raw) (1)

Severity Category Pattern File Line Description Snippet
medium fileOps Util.fileUrl BarWidget.qml 61 Resolves file URL source: Qt.resolvedUrl("Panel.qml")

Generated by omarchy-audit at 2026-08-25T09:55:14.423Z • Commit 1dcdbf7 linked to GitHub for verification • Overview