sktev/mounted-drives • aae8a87 • Scanned 8/30/2026, 1:00:06 PM
First scan — all files are new
Usual omarchy plugin add https://github.com/sktev/mounted-drives.git --enable installs latest. This pins to the exact commit audited here (aae8a87):
omarchy plugin add https://github.com/sktev/mounted-drives.git --yes && \ git -C ~/.config/omarchy/plugins/io.github.sktev.mounted-drives checkout aae8a8779c3220bd3003f47d47a4f9c2ad3175fe && \ omarchy plugin enable io.github.sktev.mounted-drives # audited commit aae8a87
Unpinned (latest): omarchy plugin add https://github.com/sktev/mounted-drives.git --enable
Shows connected external drives (USB/CD-ROM/hotplug, optionally internal NVMe/SATA) in the Omarchy bar and lets the user mount, unmount, unlock LUKS containers, open mountpoints, and safely eject/power-off disks. It auto-refreshes via udevadm block events and a fallback lsblk poll, displaying vendor/model, partition state, and errors in a popup.
Plugin is a legitimate drive manager with no arbitrary code execution; IPC exposure is standard Omarchy panel toggle with no custom payload handler, and executable resolution points to a bundled, audited Python helper executed via Process command array with fixed args.
Model opencode-go/muse-spark-1.2-contributor • 8/30/2026, 1:00:06 PM
sequenceDiagram
participant User
participant Panel as Panel.qml
participant Scanner as scripts/list_drives.py
participant LSBLK as lsblk/findmnt
participant UDisks as udisksctl
User->>Panel: Click bar icon / udev event / timer
Panel->>Scanner: Process command ["python3", "scripts/list_drives.py"]
Scanner->>LSBLK: run lsblk -J, findmnt /
LSBLK-->>Scanner: block device JSON
Scanner-->>Panel: {drives:[...]}
Panel->>User: Render drive cards (mount/unmount/unlock/eject)
User->>Panel: Mount/Unlock/Eject click (+ passphrase via stdin)
Panel->>UDisks: udisksctl mount/unmount/unlock/lock/power-off -b /dev/...Generated by AI from static findings + file context
Declares ipcTarget but defines no custom IpcHandler/onMessage handler that parses IPC payloads into shell commands; base Panel only exposes standard open/close/toggle, like all Omarchy bar widgets. No payload validation needed, not arbitrary execution.
Qt.resolvedUrl("scripts/list_drives.py") resolves a bundled helper relative to Panel.qml, not user input. Executed via Process command array ["python3", resolvedPath] with optional "--include-internal" from boolean setting; no shell interpolation and path is not attacker-controlled.
No network calls — good.
No obfuscation detected.
| Severity | Category | Pattern | File | Line | Description | Snippet |
|---|---|---|---|---|---|---|
| medium | fileOps | Util.fileUrl | Panel.qml | 52 | Resolves file URL | var cmd = ["python3", pathFromUrl(Qt.resolvedUrl("scripts/list_drives.py"))] |
These are expected Quickshell imports, not counted as risk.
| Severity | Category | Pattern | File | Line | Description | Snippet |
|---|---|---|---|---|---|---|
| info | imports | import Quickshell | Panel.qml | 3 | Expected Quickshell import — normal for Omarchy plugins (no risk) | import Quickshell |
| info | imports | import qs | Panel.qml | 5 | Expected local module import — normal for Omarchy plugins (no risk) | import qs.Commons |
| Path | Type | Lines | Size |
|---|---|---|---|
| Model.js | js | 78 | 2616 |
| Panel.qml | qml | 847 | 31764 |
| manifest.json | json | 51 | 1357 |
| Severity | Category | Pattern | File | Line | Description | Snippet |
|---|---|---|---|---|---|---|
| high | ipc | ipcTarget | Panel.qml | 12 | IPC handler exposure — no payload validation detected (handler may accept arbitrary IPC without checks) | ipcTarget: "io.github.sktev.mounted-drives" |
| medium | fileOps | Util.fileUrl | Panel.qml | 52 | Resolves file URL | var cmd = ["python3", pathFromUrl(Qt.resolvedUrl("scripts/list_drives.py"))] |
Generated by omarchy-audit at 2026-08-30T11:00:06.674Z • Commit aae8a87 linked to GitHub for verification • Overview