AI risk level

Low

Recommendation

install

Model

~deepseek/deepseek-v4-flash-latest

Analyzed commit

c00f4cb

Reviewed

1 month ago

Mesh Peek is a keyboard-first STL/3MF viewer that launches a local, token-protected Chromium/Three.js session or f3d. The code is transparent, well-commented, and includes good hygiene like SHA-256-pinned CDN downloads, temp-file atomic writes, and cache verification. No malicious, obfuscated, or destructive behavior was found; the only side effects are opt-in config changes and a short-lived localhost server.

• • The temporary local HTTP server in scripts/open-web.sh serves the entire state directory without authentication on non-model paths; the token file is readable at /token if a local process can guess the random port, though the state directory is user-only (0700) and the practical exposure is minimal.
• • scripts/install-bind.sh modifies ~/.config/hypr/bindings.lua and the resulting keybind simulates Ctrl+C in Nautilus to copy a selected file. This is documented and user-invoked, but it is still a configuration mutation and synthetic keypress behavior.
• • The viewer relies on a localhost server and Chromium; if the browser is compromised while a model is open, the copied model file is accessible on the local server until cleanup (up to 5 minutes or window close).

How this check works

This review combines the deterministic scan (the rule-based results above) with an independent look at the plugin's code by a language model. The model reads a trimmed sample of the repository's files, the manifest, and the README, then gives a plain-language risk level and a recommendation: install (no notable danger), review (look closer first), or avoid (clearly dangerous).

It runs on the same analyzed commit as the deterministic scan and is strictly advisory — it is not a security guarantee and never blocks a plugin by itself. A human moderator still reviews plugins before they are listed.

AI advisory only — automated analysis, not a security guarantee.