AI risk level

Low

Recommendation

install

Model

~deepseek/deepseek-v4-flash-latest

Analyzed commit

6121364

Reviewed

1 month ago

This is a well-structured, transparent global menu widget that renders menu data from a JSON file in the user's state directory and executes menu actions. The only notable behavior is that menu actions can execute arbitrary shell commands via `sh -c`, but this is the intended core function of a global menu system and the data source is the user's own state directory. No obfuscation, hidden persistence, credential theft, or destructive behavior was found.

• • The `activate` function in BarWidget.qml executes arbitrary shell commands from the menu data file (state/omarchy/global-menu/active.json). Any process able to write to that file could achieve code execution as the user, but this is inherent to the global menu design and the file is user-writable by default.
• • The manifest declares MIT license while the repository contains GPL-2.0 license text; this is a licensing inconsistency, not a security issue.

How this check works

This review combines the deterministic scan (the rule-based results above) with an independent look at the plugin's code by a language model. The model reads a trimmed sample of the repository's files, the manifest, and the README, then gives a plain-language risk level and a recommendation: install (no notable danger), review (look closer first), or avoid (clearly dangerous).

It runs on the same analyzed commit as the deterministic scan and is strictly advisory — it is not a security guarantee and never blocks a plugin by itself. A human moderator still reviews plugins before they are listed.

AI advisory only — automated analysis, not a security guarantee.