AI risk level

Low

Recommendation

install

Model

~deepseek/deepseek-v4-flash-latest

Analyzed commit

479e9ef

Reviewed

1 month ago

The plugin is a simple bar widget that toggles the AMD X3D scheduler mode by writing to a fixed sysfs path via pkexec. The command is constructed from hardcoded values and contains no user input, obfuscation, or hidden behavior. The only risk is that it requires root privileges and modifies a system setting, but this is clearly the intended function and is user-initiated.

• • Uses pkexec to write to a sysfs file, requiring root privileges; this is expected for the functionality but means the widget can alter system state if the user approves the prompt.
• • The notification message on failure is in German, which may be a minor localization issue but not a security concern.

How this check works

This review combines the deterministic scan (the rule-based results above) with an independent look at the plugin's code by a language model. The model reads a trimmed sample of the repository's files, the manifest, and the README, then gives a plain-language risk level and a recommendation: install (no notable danger), review (look closer first), or avoid (clearly dangerous).

It runs on the same analyzed commit as the deterministic scan and is strictly advisory — it is not a security guarantee and never blocks a plugin by itself. A human moderator still reviews plugins before they are listed.

AI advisory only — automated analysis, not a security guarantee.