AI risk level

Low

Recommendation

install

Model

~deepseek/deepseek-v4-flash-latest

Analyzed commit

b1e3327

Reviewed

1 month ago

This plugin is a straightforward QML utility for the Omarchy shell that manages a local Windows VM via Docker. It reads a read-only Docker status, invokes a pre-existing trusted command (`omarchy-windows-vm`) for start/stop/launch actions, and reads a compose file for display metadata. No signs of obfuscation, credential theft, network exfiltration, or unauthorized file modification. The deterministic scan found no issues, and manual review agrees.

• • The plugin relies on the external command `omarchy-windows-vm` and reads system files (`/var/lib/omarchy/windows/docker-compose.yml`). This is trusted code from the same package, but a malicious implementation could be abused; no such signs here.
• • It automatically starts the VM when the VM directory is created (`false->true` transition). This is a design choice and not dangerous by itself, but a user might not expect an auto-start.
• • No sandboxing of the plugin itself, but it only runs standard utilities and reads/writes via defined interfaces.

How this check works

This review combines the deterministic scan (the rule-based results above) with an independent look at the plugin's code by a language model. The model reads a trimmed sample of the repository's files, the manifest, and the README, then gives a plain-language risk level and a recommendation: install (no notable danger), review (look closer first), or avoid (clearly dangerous).

It runs on the same analyzed commit as the deterministic scan and is strictly advisory — it is not a security guarantee and never blocks a plugin by itself. A human moderator still reviews plugins before they are listed.

AI advisory only — automated analysis, not a security guarantee.