niraletter-vitals low static: low (AI confirms)

niraletter/vitals • 1dcdbf7 • Scanned 8/25/2026, 1:14:46 PM

Changed since 1dcdbf7…1dcdbf7 (0 files, 0 commits)

Score

Findings

Files

Install — pinned to audited commit

Usual omarchy plugin add https://github.com/niraletter/vitals.git --enable installs latest. This pins to the exact commit audited here (1dcdbf7):

omarchy plugin add https://github.com/niraletter/vitals.git --yes && \
  git -C ~/.config/omarchy/plugins/vitals checkout 1dcdbf754d9c35005afa5fbe58a0a261e8fe279f && \
  omarchy plugin enable vitals # audited commit 1dcdbf7

Unpinned (latest): omarchy plugin add https://github.com/niraletter/vitals.git --enable

What this plugin does

Shows a bar widget with a pinned metric (CPU, memory, network, etc.) and a dashboard with 6 tiles, per-core CPU load, graphs, storage, GPU details and a sortable/filterable process list. Users can expand tiles, pin a metric to the bar, adjust polling interval, and terminate/force-kill processes after a confirmation dialog.

AI Review

low

Plugin is a comprehensive system monitor with no malicious behavior. The sole auto-flagged finding is a false positive, and all privileged operations (proc polling, GPU tools, process termination) require explicit user interaction or system auth via pkexec.

Model opencode-go/muse-spark-1.2-contributor • 8/25/2026, 1:14:46 PM

How it works — sequence

sequenceDiagram
    participant User
    participant BarWidget
    participant Panel
    participant System as System ProcFS/Tools
    participant Priv as pkexec
    User->>BarWidget: Click widget (toggle/middle-click refresh)
    BarWidget->>Panel: Loader source Qt.resolvedUrl("Panel.qml")
    Panel->>System: Poll cat /proc/stat,/proc/meminfo, sensors -j, lspci, df, ip, ss, nvidia-smi/intel_gpu_top
    System-->>Panel: parseCpu/Memory/Network/GPU -> update tiles, graphs, tooltip
    User->>Panel: Terminate/Force kill process (confirm dialog)
    Panel->>System: kill -TERM/-KILL <pid>
    Panel->>Priv: pkexec pacman/apt-get/dnf install intel-gpu-tools or setcap cap_perfmon (Intel GPU only)
    Priv-->>Panel: exit code -> finishIntelGpuSetup

Generated by AI from static findings + file context

Findings — AI refined (1)

BarWidget.qml:61Util.fileUrlmedium →info

benign

Qt.resolvedUrl("Panel.qml") resolves an internal QML component for Loader.source, not a file URL for execution. Loader displays UI only; never passed to Process.command or execDetached.

↳ Loader { source: Qt.resolvedUrl("Panel.qml") } BarWidget.qml:61; onLoaded injectPanel() only wires bar/settings - no execution

ℹ Not an executable. Panel.qml is the plugin's own dashboard UI (imported as QML). No args, no sanitization needed; distinct from exec wrappers like mx-ctl/solaar.

Process execution

No process execution detected — good.

Network

No network calls — good.

Changed files

Changed Files (0)

No changes detected (first scan).

No obfuscation detected.

Details — hidden by default

Files opened (1) — FolderListModel, StandardPaths

Files Opened (1)

Severity	Category	Pattern	File	Line	Description	Snippet
medium	fileOps	Util.fileUrl	BarWidget.qml	61	Resolves file URL	source: Qt.resolvedUrl("Panel.qml")

Expected imports (6) — normal for Omarchy plugins

These are expected Quickshell imports, not counted as risk.

Expected Imports (6)

Severity	Category	Pattern	File	Line	Description	Snippet
info	imports	import qs	BarWidget.qml	2	Expected local module import — normal for Omarchy plugins (no risk)	import qs.Commons
info	imports	import qs	MetricTiles.qml	4	Expected local module import — normal for Omarchy plugins (no risk)	import qs.Commons
info	imports	import Quickshell	Panel.qml	4	Expected Quickshell import — normal for Omarchy plugins (no risk)	import Quickshell
info	imports	import qs	Panel.qml	6	Expected local module import — normal for Omarchy plugins (no risk)	import qs.Commons
info	imports	import Quickshell	ProcessList.qml	4	Expected Quickshell import — normal for Omarchy plugins (no risk)	import Quickshell
info	imports	import qs	ProcessList.qml	5	Expected local module import — normal for Omarchy plugins (no risk)	import qs.Commons

Full file tree (8 files)

File Tree (8 files)

Path	Type	Lines	Size
BarWidget.qml	qml	98	2471
GpuLogic.js	js	94	3066
MetricTiles.qml	qml	741	33433
Model.js	js	33	852
Panel.qml	qml	3061	111007
ProcessList.qml	qml	488	18965
ProcessLogic.js	js	67	2849
manifest.json	json	20	481

Raw static findings (1) — table view

Risk-Relevant Findings (raw) (1)

Severity	Category	Pattern	File	Line	Description	Snippet
medium	fileOps	Util.fileUrl	BarWidget.qml	61	Resolves file URL	source: Qt.resolvedUrl("Panel.qml")

Generated by omarchy-audit at 2026-08-25T11:14:46.052Z • Commit 1dcdbf7 linked to GitHub for verification • Overview