AI risk level

Low

Recommendation

review

Model

~deepseek/deepseek-v4-flash-latest

Analyzed commit

b8d45c6

Reviewed

1 month ago

System Tidy is a transparent, user-initiated cleanup widget: it lists packages, caches, startup items, and launchers, and only runs destructive commands when the user clicks a row action, with visible path/argument validation in the sampled backend.sh. The deterministic scan found nothing, and I saw no obfuscation, network exfiltration, persistence, or hidden install steps. The main remaining risk is operational—root-level pacman/rm cleanup can cause accidental data loss—and the sampled copy of backend.sh appears truncated, so the full cleanup functions should be eyeballed before publishing.

• • Performs privileged destructive operations via pkexec (pacman -Rns --noconfirm, removal of /etc *.pacnew/*.pacsave/*.pacorig files, cache/log/trash cleanup); a mis-click can remove real data, though each action is user-triggered and documented.
• • The sampled backend.sh is cut off after dir_size_mb(); the remaining cleanup/removal code in the full commit should be reviewed to confirm it uses the same validation and does not contain unsafe rm -rf paths.
• • No confirmation dialog was visible in the sampled QML; actions appear to fire directly on button click, which is acceptable but worth a human check.
• • Visible validation is good (realpath + /etc + suffix checks before root rm, temp-file + rename for autostart disabling, quoted arguments passed to omarchy/pacman/systemctl), but these patterns should be confirmed across the whole script.

How this check works

This review combines the deterministic scan (the rule-based results above) with an independent look at the plugin's code by a language model. The model reads a trimmed sample of the repository's files, the manifest, and the README, then gives a plain-language risk level and a recommendation: install (no notable danger), review (look closer first), or avoid (clearly dangerous).

It runs on the same analyzed commit as the deterministic scan and is strictly advisory — it is not a security guarantee and never blocks a plugin by itself. A human moderator still reviews plugins before they are listed.

AI advisory only — automated analysis, not a security guarantee.