Omahub
← All plugins
N

Perla

by Nawaf

Give Omarchy a voice. Perla understands, acts across your desktop, and talks back to you.

GitHub

Security review

Potentially dangerous behavior detected · 18 findings

Deterministic scan — not a security guarantee

High
Risk level
High
Analyzed commit
ea3a9b3
Scanned
1 month ago
  • high destructive_filesystem …/src/assist.rs:531

    Destructive operation on the root filesystem or a block device.

    rm -rf /\"); print(\"",
  • high destructive_filesystem …/src/omarchy.rs:701

    Destructive operation on the root filesystem or a block device.

    rm -rf /'").is_err());
  • high destructive_filesystem …/src/omarchy.rs:712

    Destructive operation on the root filesystem or a block device.

    rm -rf /'").is_err());
  • high persistence …/packaging/perla.service:1

    Bundles a systemd unit file.

    [Unit]
  • high shell_profile bin/perla-setup:266

    Redirects content into a home directory shell profile.

    or ~/.zshrc: export PATH=\"\$HOME/.local/bin:\$PATH\""
  • medium external_hosts …/src/hooks.rs:325

    Downloads or connects to an external HTTP(S) host.

    curl -s --max-time 3 -X POST \"http://127.0.0.1:{port}/hook?token={token}&ppid=$PPID\" \
  • medium package_manager …/workflows/ci.yml:16

    System package manager operation.

    apt-get install -y libasound2-dev
  • medium package_manager …/workflows/ci.yml:25

    System-wide Python package installation (not --user).

    pip install pytest ./omarchy-harness
  • medium package_manager …/workflows/release.yml:26

    System package manager operation.

    apt-get install -y libasound2-dev
  • medium package_manager …/src/types.rs:55

    Global npm package installation.

    npm i -g @anthropic-ai/claude-code`) and make sure `claude` is on your PATH.",
  • medium package_manager …/src/types.rs:56

    Global npm package installation.

    npm i -g @openai/codex`) and make sure `codex` is on your PATH.",
  • medium sudo Service.qml:130

    Command runs with sudo, elevating the process beyond the plugin environment.

    sudo for missing packages, and watching the
  • medium sudo …/workflows/ci.yml:16

    Command runs with sudo, elevating the process beyond the plugin environment.

    sudo apt-get install -y libasound2-dev
  • medium sudo …/workflows/release.yml:26

    Command runs with sudo, elevating the process beyond the plugin environment.

    sudo apt-get install -y libasound2-dev
  • medium sudo bin/perla-setup:76

    Command runs with sudo, elevating the process beyond the plugin environment.

    sudo prompt at all.
  • medium sudo bin/perla-setup:101

    Command runs with sudo, elevating the process beyond the plugin environment.

    sudo pacman -S --noconfirm --needed "${missing[@]}"
  • Docs package_manager omarchy-harness/README.md:17

    System-wide Python package installation (not --user).

    pip install -e .
  • Docs package_manager perla-voice/README.md:225

    System package manager operation.

    apt install libasound2-dev`,

Automated analysis only — not a security guarantee.

AI advisory review

Review recommended

Language-model assessment · ~deepseek/deepseek-v4-flash-latest — advisory only

Low
AI risk level
Low
Recommendation
review
Model
~deepseek/deepseek-v4-flash-latest
Analyzed commit
ea3a9b3
Reviewed
1 month ago

The deterministic scan over-flagged this plugin: the `rm -rf /` snippets are inside test/error strings, the external host is a localhost hook server, and the package-manager/sudo/shell-profile findings are in documentation, CI, or the user-initiated setup script. The plugin is a transparent AI voice assistant with an opt-in computer-use harness; it runs nothing on install and clearly discloses its capabilities and risks.

  • The setup script downloads a prebuilt binary from GitHub releases and verifies only a SHA-256 checksum from the same release, so the trust anchor is the repository itself; a compromised release could be served.
  • The computer-use harness can see the screen, type, and click as the user; this is powerful and could be abused if the AI is tricked, though it is opt-in and clearly documented.
  • The setup script uses sudo to install missing packages and modifies shell profiles to add PATH; these are user-visible and only run when the user clicks the setup button.
How this check works

This review combines the deterministic scan (the rule-based results above) with an independent look at the plugin's code by a language model. The model reads a trimmed sample of the repository's files, the manifest, and the README, then gives a plain-language risk level and a recommendation: install (no notable danger), review (look closer first), or avoid (clearly dangerous).

It runs on the same analyzed commit as the deterministic scan and is strictly advisory — it is not a security guarantee and never blocks a plugin by itself. A human moderator still reviews plugins before they are listed.

AI advisory only — automated analysis, not a security guarantee.

Install
$ omarchy plugin add https://github.com/inawafalm/omarchy-perla --enable
Productivity #bar #quickshell #ai

Perla

Give Omarchy a voice.

Talk naturally. Perla works out what you want, acts across your desktop, and tells you when it's done — it is not a dictation box. Voxtype stays your dictation tool; Perla is for conversations, actions, and spoken results.

The Perla orb listening on a dark Omarchy desktop, sound rippling outward from it

Keyboard Your voice
~45 words/min ~150 words/min

An orb in the bar, a local Rust daemon doing the realtime voice session.

Install

omarchy plugin add https://github.com/inawafalm/omarchy-perla --enable

Click the pearl in your bar, press Set up Perla, and paste your own OpenAI or xAI key when the panel asks. (Already export OPENAI_API_KEY? Setup offers to reuse it and you skip that step.)

Setup opens a terminal so you can watch it: it downloads a checksummed perla-d into ~/.local/bin, enables perla.service for your user, and only touches pacman for packages you're actually missing. Turn on Computer use first if you also want Perla to see the screen, click, and type.

omarchy plugin add deliberately runs nothing — no hooks, no sudo. That's why the last step is a button you press rather than something that happens quietly.

<details> <summary>Running setup yourself instead</summary> 
~/.config/omarchy/plugins/nawaf.perla/bin/perla-setup --help

--with-computer-use adds the harness, --from-source compiles instead of downloading, --import-env-key copies an existing key from your environment, --yes skips the prompt. Re-running is safe — it installs only what's missing.

Optional hotkeys for ~/.config/hypr/bindings.conf:

bind = SUPER ALT, SPACE, exec, perla-d toggle-listen
bind = SUPER SHIFT, BackSpace, exec, sh -c 'perla-d mute; omarchy-harness stop'

The second is a panic switch — mutes Perla, stops computer use. Perla does not take Voxtype's F9 or Super+Ctrl+X.

</details>

Using it

Left-click the orb for listen/mute. Right-click for settings: provider, voice model, how chatty the spoken progress is, and reply language. Changes reload the daemon and reconnect an active session automatically.

Remove

Right-click the orb → Uninstall the daemon…, or:

~/.config/omarchy/plugins/nawaf.perla/bin/perla-uninstall
omarchy plugin remove nawaf.perla

Your key and history survive on purpose; --purge deletes those too.

Privacy

Bring your own key — there are no credentials or Perla servers in this repo. Your key goes to the daemon over stdin, never a process argument, and lands in ~/.config/perla-voice/config.toml at mode 0600, written atomically and never through a symlink. Audio goes straight from your machine to the provider you picked, billed to your account. The local debug trail stays local unless you press Copy debug log.

Computer use can see the screen and type as your Linux user, and plugins run as unsandboxed QML inside omarchy-shell — read the source, and keep the panic switch handy. Cost controls are on by default: efficient model, bounded context, short replies, idle shutdown.

Development

node test-model.js
cargo test --manifest-path perla-voice/Cargo.toml --workspace
uv run --with pytest --with ./omarchy-harness python -m pytest omarchy-harness/tests

MIT. Copyright 2026 Nawaf.