AI risk level

Low

Recommendation

install

Model

~deepseek/deepseek-v4-flash-latest

Analyzed commit

4ad808c

Reviewed

1 month ago

The plugin is a QML panel that displays system information and provides UI controls; it executes commands via bash, but these are user-initiated actions like opening menus or launching btop. The deterministic scan found no issues, and the code is straightforward with no obfuscation or hidden behavior.

• • The plugin uses `Quickshell.execDetached` with `bash -lc` to launch commands, which could be a vector if any command strings are derived from untrusted input; however, current commands appear hardcoded and safe.
• • The plugin reads and displays external text (window titles, media titles) after sanitization, reducing but not eliminating potential UI injection risks.

How this check works

This review combines the deterministic scan (the rule-based results above) with an independent look at the plugin's code by a language model. The model reads a trimmed sample of the repository's files, the manifest, and the README, then gives a plain-language risk level and a recommendation: install (no notable danger), review (look closer first), or avoid (clearly dangerous).

It runs on the same analyzed commit as the deterministic scan and is strictly advisory — it is not a security guarantee and never blocks a plugin by itself. A human moderator still reviews plugins before they are listed.

AI advisory only — automated analysis, not a security guarantee.