{"schemaVersion":1,"id":"akitaonrails.ai-usagebar","name":"AI Usage","repo":"https://github.com/akitaonrails/ai-usagebar","listingState":"listed","marketplaceUrl":"https://plugins.omarchy.org/plugin.html?id=akitaonrails.ai-usagebar","combined":{"verdict":"caution","basis":"trusted","contested":false,"commits":["b1766cb92ebd9c98776bf1777ccfb9dc30c7b789"],"reasons":["opc [core]: caution"],"tree":"619530c40addbf8f633fb91422f5017bf309677d"},"providers":[{"provider":"opc","tier":"core","verification":"sigstore","signer":"https://github.com/PrometheusRoot/omarchy-plugin-check-data/.github/workflows/sign.yml@refs/heads/master","signedAt":"2026-10-03T20:06:23Z","commit":"b1766cb92ebd9c98776bf1777ccfb9dc30c7b789","tree":"619530c40addbf8f633fb91422f5017bf309677d","verdict":"caution","effectiveVerdict":"caution","adjustments":[],"counted":true,"timeReviewed":"2026-10-02T10:55:12Z","statement":"plugins/akitaonrails.ai-usagebar/opc/b1766cb92ebd9c98776bf1777ccfb9dc30c7b789.json","summary":"caution: external-code (14 finding(s) above info)","criteria":{"checked":["no-network","no-exec","no-persistence","no-privilege","no-obfuscation","no-secrets"],"failed":["no-exec"],"notChecked":["safe-to-run","reviewed-by-human"]},"findings":[{"category":"external-code","severity":"medium","confidence":0.8,"message":"Runs 'ai-usagebar', which is not in the repository or the Omarchy base install: its code was not reviewed (installed separately, e.g. from the AUR).","locations":[{"path":"omarchy/Panel.qml","startLine":207}]},{"category":"supply-chain","severity":"low","confidence":0.5,"message":"runtime artifacts potentially vulnerable to a cache poisoning attack (https://docs.zizmor.sh/audits/#cache-poisoning)","locations":[{"path":".github/workflows/release.yml","startLine":3}]},{"category":"external-code","severity":"low","confidence":0.9,"message":"Declares 23 runtime dependencies fetched from a package registry at install/build time (not reviewed): aes, base64, cbc, chrono, clap, ctrlc, directories, fs2 …","locations":[{"path":"Cargo.toml"}]},{"category":"exec","severity":"low","confidence":0.7,"message":"Shell command string built by concatenation inside `sh -c` — command injection if any part is untrusted (network data, file names, user input).","locations":[{"path":"gnome-extension/prefs.js","startLine":112}]},{"category":"other","severity":"low","confidence":0.6,"message":"Looks up a password from the Keychain [HIGH]","locations":[{"path":"macos/ai-usagebar-menubar.swift"}]},{"category":"other","severity":"low","confidence":0.6,"message":"sets up an embedded LaunchAgent and launches it [HIGH]","locations":[{"path":"macos/install-agent.sh"}]},{"category":"secret","severity":"low","confidence":0.6,"message":"Settings apply passes API keys to the external ai-usagebar CLI, which is not reviewed.","locations":[{"path":"omarchy/SettingsView.qml","startLine":161}]},{"category":"other","severity":"low","confidence":0.6,"message":"Looks up a password from the Keychain [HIGH]","locations":[{"path":"src/anthropic/keychain.rs"}]},{"category":"other","severity":"low","confidence":0.6,"message":"payload path [HIGH]","locations":[{"path":"src/cache.rs"}]},{"category":"other","severity":"low","confidence":0.6,"message":"payload path [HIGH]","locations":[{"path":"src/kimi/fetch.rs"}]},{"category":"secret","severity":"low","confidence":0.7,"message":"Possible hard-coded secret (Detected a Generic API Key, potentially exposing access to various services and sensitive operations.); value redacted, liveness not verified.","locations":[{"path":"src/kiro/db.rs","startLine":400}]},{"category":"other","severity":"low","confidence":0.6,"message":"payload path [HIGH]","locations":[{"path":"src/minimax/fetch.rs"}]},{"category":"other","severity":"low","confidence":0.6,"message":"Looks up a password from the Keychain [HIGH]","locations":[{"path":"src/safe_storage.rs"}]},{"category":"other","severity":"low","confidence":0.6,"message":"payload path [HIGH]","locations":[{"path":"src/supergrok/fetch.rs"}]}],"detail":{"scope":{"kind":"full","path":""},"method":["static","ai"],"target":"marketplace-listing","report":{"schemaVersion":1,"plugin":{"id":"akitaonrails.ai-usagebar","name":"AI Usage","repo":"https://github.com/akitaonrails/ai-usagebar","listingState":"listed","marketplace":{"verificationCommit":null,"listingValidatedCommit":"b1766cb92ebd9c98776bf1777ccfb9dc30c7b789","upstreamObservedCommit":"39f429ef66ff5fc1fb6561c70a9d739b908d8dbf","baselineOutcome":"passed","verificationStatus":"unverified","caps":[],"stars":597,"catalogGeneratedAt":"2026-09-30T14:53:56.598Z","manifestPath":"manifest.json","repositoryLayout":"root-plugin","author":"AkitaOnRails","description":"Multi-provider AI plan usage and balances in a native Omarchy Quattro panel. Needs the ai-usagebar binary as well as this plugin: omarchy pkg aur add ai-usagebar-bin","category":"Widgets","kind":"Bar widget","tags":["ai","bar","quickshell"],"license":"MIT","installCommand":"omarchy plugin add https://github.com/akitaonrails/ai-usagebar.git --enable"}},"review":{"commit":"b1766cb92ebd9c98776bf1777ccfb9dc30c7b789","scanTarget":"marketplace-listing","pluginPath":"","reviewedAt":"2026-10-02T10:55:12Z","aiModel":"sonnet+fable","upstreamHeadAtScan":"ad28ba6118b6ac391ea54b76a0498c76d814de22","previousCommit":null,"tools":[{"name":"inventory","version":null,"status":"ok"},{"name":"textscan","version":null,"status":"ok"},{"name":"extcode","version":null,"status":"ok"},{"name":"heckler","version":"1.0.0","status":"ok"},{"name":"ctxsentry","version":"0.5.0","status":"ok"},{"name":"opengrep","version":"1.30.0","status":"ok"},{"name":"yara","version":"4.5.4","status":"ok"},{"name":"malcontent","version":"1.26.1","status":"ok"},{"name":"shellcheck","version":"0.11.0","status":"ok"},{"name":"bandit","version":null,"status":"skipped"},{"name":"eslint","version":"10.11.0","status":"ok"},{"name":"qmllint","version":"6.4.2","status":"ok"},{"name":"gitleaks","version":"8.30.1","status":"ok"},{"name":"guarddog","version":"3.2.0","status":"ok"},{"name":"osv","version":"2.6.0","status":"failed"},{"name":"zizmor","version":"1.30.1","status":"ok"},{"name":"clamav","version":null,"status":"skipped"},{"name":"perf","version":null,"status":"ok"},{"name":"quality","version":null,"status":"ok"}],"rulesVersion":"r-05e7b1572de1","scannerVersion":"0.1.0"},"verdict":{"outcome":"caution","score":16,"hardFails":[],"aiEscalation":null,"summary":"caution: score 16; 1 medium, 12 low; uses processExec, externalCode","reasons":["capabilities: processExec","relies on external code not in the reviewed commit, so safe-to-run is not checked: ai-usagebar (binary, aur), ai-usagebar (system-package, aur), ai-usagebar-bin (system-package, aur), aes (package, cargo), base64 (package, cargo), cbc (package, cargo) +20 more"],"criteria":{"checked":["no-network","no-exec","no-persistence","no-privilege","no-obfuscation","no-secrets"],"failed":["no-exec"],"notChecked":["safe-to-run","reviewed-by-human"]}},"whatItDoes":{"oneLiner":"Bar widget that periodically runs the external ai-usagebar CLI for JSON usage and shows it in a panel, with settings that pipe API keys to the CLI.","kinds":["bar-widget"],"entryPoints":[{"key":"barWidget","path":"omarchy/BarWidget.qml"}],"manifestValid":true,"manifestError":null},"capabilities":{"processExec":{"level":"med","evidence":["F-a221d57df5e5","F-b822db682cf8","F-a699d00a7837","F-c0163704c740","F-6e3a7941ca5e","F-cb63ac414146","F-a42799075481","F-5e6df67d720c"]},"network":{"level":"none","evidence":[]},"fileWrite":{"level":"none","evidence":[]},"persistence":{"level":"none","evidence":[]},"privilege":{"level":"none","evidence":[]},"packageInstall":{"level":"none","evidence":[]},"bundledBinary":{"level":"none","evidence":[]},"clipboard":{"level":"none","evidence":[]},"screenCapture":{"level":"none","evidence":[]},"hyprlandIpc":{"level":"none","evidence":[]},"externalCode":{"level":"high","evidence":["F-9df0e6be422e","F-7fd928372ea7"],"externals":[{"name":"ai-usagebar","kind":"binary","source":"aur","evidence":["F-9df0e6be422e","F-cf4b264b48a8","F-bc1d5e0ce1a6","F-edcce107df19"]},{"name":"ai-usagebar","kind":"system-package","source":"aur","evidence":["F-24b05347190e"]},{"name":"ai-usagebar-bin","kind":"system-package","source":"aur","evidence":["F-cf4b264b48a8","F-bc1d5e0ce1a6","F-edcce107df19"]},{"name":"aes","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"base64","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"cbc","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"chrono","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"clap","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"ctrlc","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"directories","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"fs2","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"pbkdf2","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"ratatui","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"ratatui-bubbletea-components","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"ratatui-bubbletea-theme","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"reqwest","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"rusqlite","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"serde","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"serde_json","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"sha1","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"sha2","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"tempfile","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"thiserror","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"tokio","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"toml","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]},{"name":"toml_edit","kind":"package","source":"cargo","evidence":["F-7fd928372ea7"]}]}},"systemAreas":{"touched":["omarchy-shell"],"evidence":[{"area":"omarchy-shell","findings":["F-89aef16435b0","F-0b98935aa7bd"]}]},"network":{"hosts":[{"host":"127.0.0.1","schemes":["http"],"evidence":["F-8a091eab6eac","F-937370506d28","F-a7e3b21d7a0a"]},{"host":"api.anthropic.com","schemes":["https"],"evidence":["F-86f7e0a23232","F-087638c52926","F-bc2cc5406151","F-eaabed1238d0"]},{"host":"api.deepseek.com","schemes":["https"],"evidence":["F-3c53cbef219c"]},{"host":"api.kilo.ai","schemes":["https"],"evidence":["F-09911851043b"]},{"host":"api.kimi.com","schemes":["https"],"evidence":["F-effa5afcaaf4"]},{"host":"api.minimax.io","schemes":["https"],"evidence":["F-8021c84c7aa7"]},{"host":"api.minimaxi.com","schemes":["https"],"evidence":["F-8d3aeccfabfc"]},{"host":"api.moonshot.ai","schemes":["https"],"evidence":["F-e218c2244502"]},{"host":"api.moonshot.cn","schemes":["https"],"evidence":["F-ca6a03f7195b"]},{"host":"api.novita.ai","schemes":["https"],"evidence":["F-a63a94cd6564"]},{"host":"api.openai.com","schemes":["https"],"evidence":["F-be6f222a6b48","F-7a37082e4fd2"]},{"host":"api.z.ai","schemes":["https"],"evidence":["F-c915476926f4","F-25de4fe53deb"]},{"host":"auth.openai.com","schemes":["https"],"evidence":["F-4621f01e66d1"]},{"host":"chatgpt.com","schemes":["https"],"evidence":["F-d832236ecba3","F-b952226f2b9f"]},{"host":"codewhisperer.us-east-1.amazonaws.com","schemes":["https"],"evidence":["F-4a87ce20b8a1"]},{"host":"cursor.com","schemes":["https"],"evidence":["F-7eb827f40213"]},{"host":"docs.aws.amazon.com","schemes":["https"],"evidence":["F-4547a43ec67d"]},{"host":"docs.x.ai","schemes":["https"],"evidence":["F-2a44186da8d4"]},{"host":"github.com","schemes":["https"],"evidence":["F-454d72bc4d6b","F-72d594b4239c","F-615127b9001d","F-c24230d60b6b","F-cefe99a2ef6a","F-9ffd4dbd7a0e"]},{"host":"idp-a.test","schemes":["https"],"evidence":["F-a380368f99ae"]},{"host":"idp-b.test","schemes":["https"],"evidence":["F-9b5f212a5f9d"]},{"host":"localhost","schemes":["http"],"evidence":["F-d6ca150091a1","F-073bf0768593"]},{"host":"management-api.x.ai","schemes":["https"],"evidence":["F-06d2d33a0c66"]},{"host":"novita.ai","schemes":["https"],"evidence":["F-7bb1d950fcc8"]},{"host":"oidc.us-east-1.amazonaws.com","schemes":["https"],"evidence":["F-296258cdfe95"]},{"host":"oidc.us-gov-west-1.amazonaws.com","schemes":["https"],"evidence":["F-b46ac015dac3"]},{"host":"openrouter.ai","schemes":["https"],"evidence":["F-e3518096a36e"]},{"host":"platform.claude.com","schemes":["https"],"evidence":["F-fae2841d18bb","F-fd781f6473a6","F-81cd713f7de8"]},{"host":"www.apple.com","schemes":["http"],"evidence":["F-926a9faf2be0"]}]},"dependencies":{"packages":[{"name":"tokio","version":"1","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"reqwest","version":"0.12","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"serde","version":"1","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"serde_json","version":"1","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"toml","version":"0.8","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"toml_edit","version":"0.25","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"clap","version":"4","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"chrono","version":"0.4","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"fs2","version":"0.4","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"tempfile","version":"3","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"directories","version":"6","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"thiserror","version":"2","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"ctrlc","version":"3","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"base64","version":"0.23","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"aes","version":"0.8","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"cbc","version":"0.1","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"pbkdf2","version":"0.13","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"sha1","version":"0.11","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"sha2","version":"0.10","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"ratatui","version":"0.30.1","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"ratatui-bubbletea-components","version":"0.2","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"ratatui-bubbletea-theme","version":"0.2","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"rusqlite","version":"0.39","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"mockito","version":"1","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"insta","version":"1","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"pretty_assertions","version":"1","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"},{"name":"tempfile","version":"3","ecosystem":"cargo","direct":true,"pinned":true,"manifestPath":"Cargo.toml"}],"systemPackages":[{"name":"ai-usagebar","source":"aur","evidence":["F-ac6d75c2386a","F-24b05347190e"]},{"name":"ai-usagebar-bin","source":"aur","evidence":["F-511e84dc46f8","F-cf4b264b48a8","F-bc1d5e0ce1a6","F-edcce107df19"]}],"vulnerabilities":[]},"secrets":{"count":1,"items":[{"findingId":"F-c1b535e8d273","kind":"generic-api-key","live":null}]},"supplyChain":{"scorecard":null,"pinnedDeps":true,"signedCommitRatio":0.4,"busFactor":1,"repoAgeDays":131,"unpinnedRemoteFetches":[]},"injection":{"hiddenUnicode":{"count":0,"evidence":[]},"promptInjection":{"count":0,"evidence":[]},"obfuscation":{"count":0,"evidence":[]}},"codeQuality":{"loc":{"total":49709,"byLanguage":[{"language":"Rust","files":113,"lines":42796},{"language":"Swift","files":2,"lines":3209},{"language":"JavaScript","files":6,"lines":1657},{"language":"QML","files":3,"lines":1082},{"language":"YAML","files":3,"lines":411},{"language":"TOML","files":2,"lines":335},{"language":"Shell","files":5,"lines":160},{"language":"Makefile","files":1,"lines":33},{"language":"CSS","files":1,"lines":26}]},"lint":[{"tool":"shellcheck","errors":1,"warnings":17},{"tool":"eslint","errors":3,"warnings":40},{"tool":"qmllint","errors":0,"warnings":1160}],"tests":{"present":true,"files":5},"docs":{"readme":true,"changelog":true},"license":{"spdx":"MIT","file":true},"hotspots":[{"path":"omarchy/Panel.qml","reason":"r.5b0c49abe65e"},{"path":".github/workflows/release.yml","reason":"r.738c1f331045"},{"path":"Cargo.toml","reason":"r.66259759e39a"},{"path":"gnome-extension/prefs.js","reason":"r.01e0e842c851"},{"path":"macos/ai-usagebar-menubar.swift","reason":"r.61ca01356bc1"},{"path":"macos/install-agent.sh","reason":"r.1bf2a0b4b5c8"},{"path":"src/anthropic/keychain.rs","reason":"r.61ca01356bc1"},{"path":"src/cache.rs","reason":"r.5dc13594e86f"}]},"performance":{"timers":[{"path":"omarchy/Panel.qml","line":189,"intervalMs":null,"repeat":true,"spawnsProcess":false},{"path":"omarchy/Panel.qml","line":197,"intervalMs":30000,"repeat":true,"spawnsProcess":false}],"estSpawnsPerMin":0.0,"keepLoaded":true,"largeAssets":[{"path":"screenshot.png","bytes":3848848}],"polling":["F-bc8ca7f997c9"]},"maintenance":{"lastCommitAt":"2026-08-14T21:40:49Z","commits90d":265,"contributors":23,"openIssues":null,"archived":null,"latestRelease":"v1.4.0"},"diffSinceLastReview":null,"findings":[{"id":"F-5e21f4a7a640","source":"zizmor","ruleId":"r.ab9fa6693ebd","severity":"info","confidence":0.9,"path":".github/dependabot.yml","line":3,"snippet":"package-ecosystem: github-actions","message":"insufficient cooldown in Dependabot updates (https://docs.zizmor.sh/audits/#dependabot-cooldown)","category":"supply-chain","hardFail":false},{"id":"F-53a663d3e328","source":"zizmor","ruleId":"r.ab9fa6693ebd","severity":"info","confidence":0.9,"path":".github/dependabot.yml","line":8,"snippet":"package-ecosystem: cargo","message":"insufficient cooldown in Dependabot updates (https://docs.zizmor.sh/audits/#dependabot-cooldown)","category":"supply-chain","hardFail":false},{"id":"F-85a7c9158465","source":"zizmor","ruleId":"r.f629672d34ab","severity":"info","confidence":0.5,"path":".github/workflows/ci.yml","line":26,"snippet":"uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1","message":"credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)","category":"supply-chain","hardFail":false},{"id":"F-e70b02ad3a82","source":"zizmor","ruleId":"r.f629672d34ab","severity":"info","confidence":0.5,"path":".github/workflows/ci.yml","line":53,"snippet":"uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1","message":"credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)","category":"supply-chain","hardFail":false},{"id":"F-cf4e6bb9d749","source":"zizmor","ruleId":"r.f629672d34ab","severity":"info","confidence":0.5,"path":".github/workflows/ci.yml","line":70,"snippet":"uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1","message":"credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)","category":"supply-chain","hardFail":false},{"id":"F-17b7a81ea7cb","source":"zizmor","ruleId":"r.f629672d34ab","severity":"info","confidence":0.5,"path":".github/workflows/ci.yml","line":92,"snippet":"uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1","message":"credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)","category":"supply-chain","hardFail":false},{"id":"F-24d84c301ed2","source":"zizmor","ruleId":"r.02ed6a656740","severity":"low","confidence":0.5,"path":".github/workflows/release.yml","line":3,"snippet":"on:   push:     tags: [\"v*\"]   workflow_dispatch:     inputs:       ref:         description: \"Existing release tag to build (e.g. v0.13.1)\"         required: true         default: \"\"","message":"runtime artifacts potentially vulnerable to a cache poisoning attack (https://docs.zizmor.sh/audits/#cache-poisoning)","category":"supply-chain","hardFail":false},{"id":"F-2698fb28636d","source":"zizmor","ruleId":"r.f629672d34ab","severity":"info","confidence":0.5,"path":".github/workflows/release.yml","line":26,"snippet":"uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1         with:           ref: ${{ inputs.ref || github.ref }}           # Tags are needed to prove a workflow_dispatch ref is a real tag.           fetch-depth: 0","message":"credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)","category":"supply-chain","hardFail":false},{"id":"F-c0c6096426f9","source":"zizmor","ruleId":"r.f629672d34ab","severity":"info","confidence":0.5,"path":".github/workflows/release.yml","line":100,"snippet":"uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1         with:           ref: ${{ inputs.ref || github.ref }}","message":"credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)","category":"supply-chain","hardFail":false},{"id":"F-43e76c17a128","source":"opengrep","ruleId":"r.35725ec3d681","severity":"info","confidence":0.9,"path":".github/workflows/release.yml","line":117,"snippet":"run: sudo apt-get update && sudo apt-get install -y nasm","message":"Runs commands as root via sudo/doas/run0.","category":"privilege","hardFail":false},{"id":"F-fea1de6aa5f0","source":"zizmor","ruleId":"r.f629672d34ab","severity":"info","confidence":0.5,"path":".github/workflows/release.yml","line":162,"snippet":"name: Checkout source (for CHANGELOG + previous tag)         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1         with:           ref: ${{ inputs.ref || github.ref }}           fetch-depth: 0","message":"credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)","category":"supply-chain","hardFail":false},{"id":"F-a452f591f458","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":".github/workflows/release.yml","line":206,"snippet":"echo \"yay -S ai-usagebar-bin      # prebuilt binary from this release\"","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-7f35461e2782","source":"opengrep","ruleId":"r.77dfe677dff7","severity":"info","confidence":0.9,"path":".github/workflows/release.yml","line":206,"snippet":"echo \"yay -S ai-usagebar-bin      # prebuilt binary from this release\"","message":"Installs system packages (pacman / AUR helper / omarchy pkg).","category":"package","hardFail":false},{"id":"F-511e84dc46f8","source":"textscan","ruleId":"r.f93d25679c59","severity":"info","confidence":1.0,"path":".github/workflows/release.yml","line":206,"snippet":"echo \"yay -S ai-usagebar-bin      # prebuilt binary from this release\"","message":"System package referenced for install: ai-usagebar-bin (aur)","category":"package","hardFail":false},{"id":"F-d39978114305","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":".github/workflows/release.yml","line":207,"snippet":"echo \"yay -S ai-usagebar          # compiles from source\"","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-7f45cfc4fe13","source":"opengrep","ruleId":"r.77dfe677dff7","severity":"info","confidence":0.9,"path":".github/workflows/release.yml","line":207,"snippet":"echo \"yay -S ai-usagebar          # compiles from source\"","message":"Installs system packages (pacman / AUR helper / omarchy pkg).","category":"package","hardFail":false},{"id":"F-ac6d75c2386a","source":"textscan","ruleId":"r.f93d25679c59","severity":"info","confidence":1.0,"path":".github/workflows/release.yml","line":207,"snippet":"echo \"yay -S ai-usagebar          # compiles from source\"","message":"System package referenced for install: ai-usagebar (aur)","category":"package","hardFail":false},{"id":"F-b76cb5870c5f","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":".github/workflows/release.yml","line":213,"snippet":"echo \"curl -fsSL https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}/ai-usagebar-linux-x86_64.tar.gz | tar xz -C ~/.local/bin ai-usagebar ai-usagebar-tui\"","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-00e51592d80d","source":"zizmor","ruleId":"r.f629672d34ab","severity":"info","confidence":0.5,"path":".github/workflows/release.yml","line":252,"snippet":"uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1         with:           ref: ${{ inputs.ref || github.ref }}","message":"credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)","category":"supply-chain","hardFail":false},{"id":"F-fc6b388837a6","source":"zizmor","ruleId":"r.0691a68253fe","severity":"info","confidence":0.9,"path":".github/workflows/release.yml","line":257,"snippet":"name: Publish to crates.io         env:           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}         run: |           if [ -z \"$CARGO_REGISTRY_TOKEN\" ]; then             echo \"::warning::Skipping crates.io publish — no CARGO_REGISTRY_TOKEN secret set\"             exit 0           fi","message":"prefer trusted publishing for authentication (https://docs.zizmor.sh/audits/#use-trusted-publishing)","category":"supply-chain","hardFail":false},{"id":"F-4d6817995919","source":"zizmor","ruleId":"r.f629672d34ab","severity":"info","confidence":0.5,"path":".github/workflows/release.yml","line":287,"snippet":"uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1         with:           ref: ${{ inputs.ref || github.ref }}","message":"credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)","category":"supply-chain","hardFail":false},{"id":"F-09347ae6da6a","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":".github/workflows/release.yml","line":304,"snippet":"SRC_SHA=$(curl -fsSL \"$SRC_URL\" | sha256sum | awk '{print $1}')","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-c3e3a11eed68","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":".github/workflows/release.yml","line":314,"snippet":"# `-bin` variant under that name. Without this, makepkg generates","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-3affa6a5db7e","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":".github/workflows/release.yml","line":333,"snippet":"# regenerates .SRCINFO via makepkg, then commits + pushes via SSH.","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-2f5ea939391f","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":".gitignore","line":18,"snippet":"# makepkg build outputs (kept out of the source repo)","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-ee5e182f6732","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"CHANGELOG.md","line":34,"snippet":"installable with `omarchy plugin add` and renders every configured provider","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-cc76f57793af","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"CHANGELOG.md","line":83,"snippet":"`cargo install --list`.","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-e86a453d3ce6","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":"CHANGELOG.md","line":1179,"snippet":"intact. Result: `makepkg --printsrcinfo` ran against the old file,","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-e98f23f9ff97","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"CHANGELOG.md","line":1211,"snippet":"- **Published to crates.io** — `cargo install ai-usagebar` works on","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-aaba8fd213b9","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":"CHANGELOG.md","line":1218,"snippet":"`ai-usagebar-bin` AUR package uses, just without yay. Metadata in","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-ea6d2f6bb3df","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":"CHANGELOG.md","line":1310,"snippet":"same way as x86_64 users: `yay -S ai-usagebar-bin`.","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-c0a376e8bd7d","source":"opengrep","ruleId":"r.77dfe677dff7","severity":"info","confidence":0.9,"path":"CHANGELOG.md","line":1310,"snippet":"same way as x86_64 users: `yay -S ai-usagebar-bin`.","message":"Installs system packages (pacman / AUR helper / omarchy pkg).","category":"package","hardFail":false},{"id":"F-cf4b264b48a8","source":"textscan","ruleId":"r.f93d25679c59","severity":"info","confidence":1.0,"path":"CHANGELOG.md","line":1310,"snippet":"same way as x86_64 users: `yay -S ai-usagebar-bin`.","message":"System package referenced for install: ai-usagebar-bin (aur)","category":"package","hardFail":false},{"id":"F-6265363a7d4c","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":"CHANGELOG.md","line":1362,"snippet":"both PKGBUILDs now declare the cross-variant `conflicts` so pacman","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-8f0924e437ca","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":"CLAUDE.md","line":24,"snippet":"cd packaging/aur && makepkg --printsrcinfo > .SRCINFO","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-ac39620afe5d","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":"CLAUDE.md","line":25,"snippet":"# PKGBUILD-bin must be named PKGBUILD for makepkg — use a scratch dir:","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-9d4a70ac1f6f","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":"CLAUDE.md","line":27,"snippet":"(cd \"$t\" && makepkg --printsrcinfo > .SRCINFO-bin) &&","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-3af7687d0338","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"CLAUDE.md","line":37,"snippet":"omarchy plugin validate .                   # plugin manifest + entry points","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-b3a7fdb12de3","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"CLAUDE.md","line":60,"snippet":"curl -sLO https://github.com/akitaonrails/ai-usagebar/archive/refs/tags/vX.Y.Z.tar.gz","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-361fbcc81acc","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"CLAUDE.md","line":63,"snippet":"curl -sL https://github.com/akitaonrails/ai-usagebar/releases/download/vX.Y.Z/ai-usagebar-linux-x86_64.tar.gz.sha256","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-f85d3abcdbb7","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"CLAUDE.md","line":65,"snippet":"curl -sL https://github.com/akitaonrails/ai-usagebar/releases/download/vX.Y.Z/ai-usagebar-linux-aarch64.tar.gz.sha256","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-b27ca239fc05","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":"CLAUDE.md","line":105,"snippet":"during `makepkg`, so any test that reads a user's *customized* files","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-51c0b49cd336","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"CLAUDE.md","line":141,"snippet":"1. Capture the actual response (`curl -sH \"Authorization: …\" …`).","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-7fd928372ea7","source":"extcode","ruleId":"r.66259759e39a","severity":"low","confidence":0.9,"path":"Cargo.toml","line":0,"snippet":"","message":"Declares 23 runtime dependencies fetched from a package registry at install/build time (not reviewed): aes, base64, cbc, chrono, clap, ctrlc, directories, fs2 …","category":"external-code","hardFail":false},{"id":"F-454d72bc4d6b","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Cargo.toml","line":9,"snippet":"repository = \"https://github.com/akitaonrails/ai-usagebar\"","message":"URL literal: https://github.com","category":"network","hardFail":false},{"id":"F-a679cee519b2","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"README.md","line":15,"snippet":"`omarchy plugin add` on Omarchy 4.","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-fe00c804dda4","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"README.md","line":41,"snippet":"omarchy pkg aur add ai-usagebar-bin","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-d8f312eef3ab","source":"opengrep","ruleId":"r.77dfe677dff7","severity":"info","confidence":0.9,"path":"README.md","line":41,"snippet":"omarchy pkg aur add ai-usagebar-bin","message":"Installs system packages (pacman / AUR helper / omarchy pkg).","category":"package","hardFail":false},{"id":"F-bc1d5e0ce1a6","source":"textscan","ruleId":"r.f93d25679c59","severity":"info","confidence":1.0,"path":"README.md","line":41,"snippet":"omarchy pkg aur add ai-usagebar-bin","message":"System package referenced for install: ai-usagebar-bin (aur)","category":"package","hardFail":false},{"id":"F-ef450243f895","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"README.md","line":42,"snippet":"omarchy plugin add https://github.com/akitaonrails/ai-usagebar.git --enable","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-6bb0be0e3b51","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":"README.md","line":53,"snippet":"yay -S ai-usagebar-bin    # prebuilt binary from GitHub Releases (fast, ~5s install)","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-b57641c09ce8","source":"opengrep","ruleId":"r.77dfe677dff7","severity":"info","confidence":0.9,"path":"README.md","line":53,"snippet":"yay -S ai-usagebar-bin    # prebuilt binary from GitHub Releases (fast, ~5s install)","message":"Installs system packages (pacman / AUR helper / omarchy pkg).","category":"package","hardFail":false},{"id":"F-7a50e79a4bbf","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":"README.md","line":54,"snippet":"yay -S ai-usagebar        # compiles from source (~30-60s, hermetic)","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-48ae9db462b4","source":"opengrep","ruleId":"r.77dfe677dff7","severity":"info","confidence":0.9,"path":"README.md","line":54,"snippet":"yay -S ai-usagebar        # compiles from source (~30-60s, hermetic)","message":"Installs system packages (pacman / AUR helper / omarchy pkg).","category":"package","hardFail":false},{"id":"F-24b05347190e","source":"textscan","ruleId":"r.f93d25679c59","severity":"info","confidence":1.0,"path":"README.md","line":54,"snippet":"yay -S ai-usagebar        # compiles from source (~30-60s, hermetic)","message":"System package referenced for install: ai-usagebar (aur)","category":"package","hardFail":false},{"id":"F-08f68efcc37e","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":"README.md","line":57,"snippet":"The `-bin` variant downloads the same x86_64 ELF that CI built and tested. The source variant compiles locally with your toolchain. Both install identical binaries to `/usr/bin/`. If you already have one installed, switch with `yay -S` the other package; pacman handles the swap through `conflicts`/`provides`.","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-c68469c5ff60","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"README.md","line":62,"snippet":"cargo install ai-usagebar                # compile from source (needs rustup)","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-5380c3ed18a8","source":"opengrep","ruleId":"r.35725ec3d681","severity":"info","confidence":0.9,"path":"README.md","line":72,"snippet":"sudo make install                  # → /usr/local/bin","message":"Runs commands as root via sudo/doas/run0.","category":"privilege","hardFail":false},{"id":"F-682b45cdb73a","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"README.md","line":347,"snippet":"omarchy plugin update akitaonrails.ai-usagebar","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-0f0b139c1655","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"README.md","line":348,"snippet":"omarchy plugin remove akitaonrails.ai-usagebar","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-6ec3aab8b925","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"README.md","line":704,"snippet":"# ai-usagebar TUI — float + center + fixed size. omarchy-launch-tui sets the","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-0d67e9e8f2da","source":"opengrep","ruleId":"r.a6508187cdf9","severity":"info","confidence":0.9,"path":"README.md","line":712,"snippet":"Then `hyprctl reload` (no logout needed).","message":"Dispatches Hyprland actions (controls windows/workspaces/keybinds).","category":"other","hardFail":false},{"id":"F-c18239b2ea34","source":"opengrep","ruleId":"r.60ddc78b4162","severity":"info","confidence":0.9,"path":"README.md","line":712,"snippet":"Then `hyprctl reload` (no logout needed).","message":"Talks to the Hyprland compositor (hyprctl / IPC socket / Quickshell.Hyprland).","category":"other","hardFail":false},{"id":"F-0794679f7ee9","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"README.md","line":714,"snippet":"> Omarchy tags a hardcoded list of TUI app-ids with `floating-window` in `~/.local/share/omarchy/default/hypr/apps/system.conf`, which then applies `float + center + size 875 600`. The rules above set those values directly, so the size is deterministic regardless of which config is sourced first. If you launch the TUI differently (e.g. `kitty -e ai-usagebar-tui`), replace the class regex with what","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-c88e90e57bc2","source":"opengrep","ruleId":"r.60ddc78b4162","severity":"info","confidence":0.9,"path":"README.md","line":714,"snippet":"> Omarchy tags a hardcoded list of TUI app-ids with `floating-window` in `~/.local/share/omarchy/default/hypr/apps/system.conf`, which then applies `float + center + size 875 600`. The rules above set those values directly, so the size is deterministic regardless of which config is sourced first. If you launch the TUI differently (e.g. `kitty -e ai-usagebar-tui`), replace the class regex with what","message":"Talks to the Hyprland compositor (hyprctl / IPC socket / Quickshell.Hyprland).","category":"other","hardFail":false},{"id":"F-ffcd28232804","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"README.md","line":927,"snippet":"- Auto-merges with the active Omarchy theme at `~/.config/omarchy/current/theme/colors.toml`.","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-72d594b4239c","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"config.example.toml","line":60,"snippet":"# Defaults to the store claude-acc creates (https://github.com/ohmaseclaro/claude-acc);","message":"URL literal: https://github.com","category":"network","hardFail":false},{"id":"F-fae2841d18bb","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"config.example.toml","line":77,"snippet":"# https://platform.claude.com/docs/en/manage-claude/usage-cost-api","message":"URL literal: https://platform.claude.com","category":"network","hardFail":false},{"id":"F-6729672a82bd","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"gnome-extension/README.md","line":34,"snippet":"path in preferences). Install it with `cargo install ai-usagebar` or from","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-228a186e392b","source":"malcontent","ruleId":"r.e764edde6b0e","severity":"info","confidence":0.6,"path":"gnome-extension/extension.js","line":0,"snippet":"['./marker-logic']","message":"references and possibly executes relative path [MEDIUM]","category":"other","hardFail":false},{"id":"F-d3d1d598b969","source":"malcontent","ruleId":"r.b422e837e9e7","severity":"info","confidence":0.6,"path":"gnome-extension/install.sh","line":0,"snippet":"['rm -rf']","message":"Forcibly deletes files recursively [MEDIUM]","category":"other","hardFail":false},{"id":"F-22e644876592","source":"opengrep","ruleId":"r.908f9c86757d","severity":"info","confidence":0.9,"path":"gnome-extension/install.sh","line":31,"snippet":"echo \"Logs:  journalctl -f -o cat /usr/bin/gnome-shell\"","message":"Uses systemd tooling.","category":"other","hardFail":false},{"id":"F-bc8ca7f997c9","source":"perf","ruleId":"r.3b120065ac8b","severity":"info","confidence":1.0,"path":"gnome-extension/install.sh","line":31,"snippet":"journalctl -f","message":"Long-running follower/event stream process.","category":"performance","hardFail":false},{"id":"F-00d7b8babad3","source":"malcontent","ruleId":"r.e764edde6b0e","severity":"info","confidence":0.6,"path":"gnome-extension/marker-logic.test.mjs","line":0,"snippet":"['./marker-logic']","message":"references and possibly executes relative path [MEDIUM]","category":"other","hardFail":false},{"id":"F-707741780d31","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"gnome-extension/marker-logic.test.mjs","line":115,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-615127b9001d","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"gnome-extension/metadata.json","line":4,"snippet":"\"description\": \"Claude, Codex, and other AI plan usage in the GNOME top panel, next to the clock/network: quota bars with the full tooltip in a native dropdown. Backed by the `ai-usagebar` binary (htt","message":"URL literal: https://github.com","category":"network","hardFail":false},{"id":"F-05436db00380","source":"malcontent","ruleId":"r.1efae2d4d298","severity":"info","confidence":0.6,"path":"gnome-extension/prefs.js","line":0,"snippet":"[\"'bash'\"]","message":"executes shell [MEDIUM]","category":"other","hardFail":false},{"id":"F-27e04531711a","source":"malcontent","ruleId":"r.0a992cf3dce0","severity":"info","confidence":0.6,"path":"gnome-extension/prefs.js","line":0,"snippet":"['>/dev/null 2>&1']","message":"Runs shell commands but throws output away [MEDIUM]","category":"other","hardFail":false},{"id":"F-a6836448fd3c","source":"malcontent","ruleId":"r.c69c96401225","severity":"info","confidence":0.6,"path":"gnome-extension/prefs.js","line":0,"snippet":"['sudo is needed even when the']","message":"calls sudo [MEDIUM]","category":"other","hardFail":false},{"id":"F-c0163704c740","source":"opengrep","ruleId":"r.145d7e49b5e9","severity":"info","confidence":0.9,"path":"gnome-extension/prefs.js","line":77,"snippet":"['kgx', '--', 'bash', '-lc', command],","message":"Runs a shell command string via `sh -c`.","category":"exec","hardFail":false},{"id":"F-6e3a7941ca5e","source":"opengrep","ruleId":"r.145d7e49b5e9","severity":"info","confidence":0.9,"path":"gnome-extension/prefs.js","line":78,"snippet":"['gnome-terminal', '--', 'bash', '-lc', command],","message":"Runs a shell command string via `sh -c`.","category":"exec","hardFail":false},{"id":"F-cb63ac414146","source":"opengrep","ruleId":"r.145d7e49b5e9","severity":"info","confidence":0.9,"path":"gnome-extension/prefs.js","line":79,"snippet":"['xterm', '-e', 'bash', '-lc', command],","message":"Runs a shell command string via `sh -c`.","category":"exec","hardFail":false},{"id":"F-a42799075481","source":"opengrep","ruleId":"r.145d7e49b5e9","severity":"info","confidence":0.9,"path":"gnome-extension/prefs.js","line":112,"snippet":"['bash', '-lc', `command -v ${cli}`],","message":"Runs a shell command string via `sh -c`.","category":"exec","hardFail":false},{"id":"F-5e6df67d720c","source":"opengrep","ruleId":"r.01e0e842c851","severity":"low","confidence":0.7,"path":"gnome-extension/prefs.js","line":112,"snippet":"['bash', '-lc', `command -v ${cli}`],","message":"Shell command string built by concatenation inside `sh -c` — command injection if any part is untrusted (network data, file names, user input).","category":"exec","hardFail":false},{"id":"F-f9390b016743","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"macos/INSTALL.md","line":11,"snippet":"| **`ai-usagebar` binary** | `cargo install ai-usagebar` (lands in `~/.cargo/bin`) |","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-1263ded005de","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"macos/INSTALL.md","line":27,"snippet":"cargo install ai-usagebar","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-69baa2699d92","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"macos/INSTALL.md","line":106,"snippet":"| Menu bar shows `⚠ ai` | the binary wasn't found — `cargo install ai-usagebar`, or set its path; it's searched in `~/.cargo/bin`, `/opt/homebrew/bin`, `/usr/local/bin`, then `PATH` |","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-6d7c6fc9e306","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"macos/README.md","line":46,"snippet":"- The `ai-usagebar` binary on the Mac. Install it with `cargo install ai-usagebar`","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-1fc2f41e0f97","source":"malcontent","ruleId":"r.61ca01356bc1","severity":"low","confidence":0.6,"path":"macos/ai-usagebar-menubar.swift","line":0,"snippet":"['find-generic-password']","message":"Looks up a password from the Keychain [HIGH]","category":"other","hardFail":false},{"id":"F-68c0ac067a19","source":"malcontent","ruleId":"r.a5934ed7d04a","severity":"info","confidence":0.6,"path":"macos/ai-usagebar-menubar.swift","line":0,"snippet":"['subprocess']","message":"execute external program [MEDIUM]","category":"other","hardFail":false},{"id":"F-69f2979fef87","source":"malcontent","ruleId":"r.ee82497fc5a2","severity":"info","confidence":0.6,"path":"macos/ai-usagebar-menubar.swift","line":0,"snippet":"['osascript']","message":"runs osascript [MEDIUM]","category":"other","hardFail":false},{"id":"F-073e373b9648","source":"malcontent","ruleId":"r.1efae2d4d298","severity":"info","confidence":0.6,"path":"macos/ai-usagebar-menubar.swift","line":0,"snippet":"['/bin/bash']","message":"executes shell [MEDIUM]","category":"other","hardFail":false},{"id":"F-346e29b5fea7","source":"malcontent","ruleId":"r.0a992cf3dce0","severity":"info","confidence":0.6,"path":"macos/ai-usagebar-menubar.swift","line":0,"snippet":"['>/dev/null 2>&1']","message":"Runs shell commands but throws output away [MEDIUM]","category":"other","hardFail":false},{"id":"F-ab88eb3f58bc","source":"malcontent","ruleId":"r.e764edde6b0e","severity":"info","confidence":0.6,"path":"macos/ai-usagebar-menubar.swift","line":0,"snippet":"['./install-agent']","message":"references and possibly executes relative path [MEDIUM]","category":"other","hardFail":false},{"id":"F-85397a2c9827","source":"malcontent","ruleId":"r.cfb405defdf7","severity":"info","confidence":0.6,"path":"macos/ai-usagebar-menubar.swift","line":0,"snippet":"['/usr/local/bin/']","message":"path reference within /usr/local/bin [MEDIUM]","category":"other","hardFail":false},{"id":"F-078ee9a07ad6","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"macos/ai-usagebar-menubar.swift","line":0,"snippet":"['agent']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-1771770b73bb","source":"malcontent","ruleId":"r.1bf2a0b4b5c8","severity":"info","confidence":0.6,"path":"macos/ai-usagebar-menubar.swift","line":0,"snippet":"['/Library/LaunchAgents/', '~/Library/LaunchAgents']","message":"sets up a LaunchAgent and launches it [MEDIUM]","category":"other","hardFail":false},{"id":"F-33e498f6d282","source":"malcontent","ruleId":"r.c69c96401225","severity":"info","confidence":0.6,"path":"macos/ai-usagebar-menubar.swift","line":0,"snippet":"['sudo']","message":"calls sudo [MEDIUM]","category":"other","hardFail":false},{"id":"F-b7bcbae04d18","source":"malcontent","ruleId":"r.cb18343e780e","severity":"info","confidence":0.6,"path":"macos/ai-usagebar-menubar.swift","line":0,"snippet":"['intercepting']","message":"References interception [MEDIUM]","category":"other","hardFail":false},{"id":"F-7d97413a5273","source":"opengrep","ruleId":"r.4ef0e1a65284","severity":"info","confidence":0.9,"path":"macos/ai-usagebar-tests.swift","line":632,"snippet":"let nasty = addAccountScript(binary: \"/b\", label: \"a'; rm -rf ~; echo '\", desktop: false)","message":"Recursive delete of the home directory or a top-level config tree.","category":"filesystem","hardFail":false},{"id":"F-594f5b47a1bc","source":"opengrep","ruleId":"r.4ef0e1a65284","severity":"info","confidence":0.9,"path":"macos/ai-usagebar-tests.swift","line":633,"snippet":"assertEqual(nasty.contains(\"rm -rf ~;\\n\"), false, \"injected command stays inside the quotes\")","message":"Recursive delete of the home directory or a top-level config tree.","category":"filesystem","hardFail":false},{"id":"F-c26d98b365b7","source":"opengrep","ruleId":"r.4ef0e1a65284","severity":"info","confidence":0.9,"path":"macos/ai-usagebar-tests.swift","line":634,"snippet":"assertEqual(nasty.contains(#\"'a'\\''; rm -rf ~; echo '\\'''\"#), true, \"label is escaped\")","message":"Recursive delete of the home directory or a top-level config tree.","category":"filesystem","hardFail":false},{"id":"F-9f0fc2b06a42","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"macos/build.sh","line":0,"snippet":"['agent']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-755aa623ce2c","source":"malcontent","ruleId":"r.1bf2a0b4b5c8","severity":"low","confidence":0.6,"path":"macos/install-agent.sh","line":0,"snippet":"['HOME/Library/LaunchAgents/$LABEL.plist', '<key>ProgramArguments</key>', 'launchctl load']","message":"sets up an embedded LaunchAgent and launches it [HIGH]","category":"other","hardFail":false},{"id":"F-926a9faf2be0","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"macos/install-agent.sh","line":31,"snippet":"<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">","message":"URL literal: http://www.apple.com","category":"network","hardFail":false},{"id":"F-8fd40d113e4c","source":"malcontent","ruleId":"r.b422e837e9e7","severity":"info","confidence":0.6,"path":"macos/run-tests.sh","line":0,"snippet":"['rm -rf']","message":"Forcibly deletes files recursively [MEDIUM]","category":"other","hardFail":false},{"id":"F-314523f8a39d","source":"malcontent","ruleId":"r.e764edde6b0e","severity":"info","confidence":0.6,"path":"macos/run-tests.sh","line":0,"snippet":"['./macos']","message":"references and possibly executes relative path [MEDIUM]","category":"other","hardFail":false},{"id":"F-89aef16435b0","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"omarchy/BarWidget.qml","line":44,"snippet":"if (root.bar) root.bar.run(\"omarchy-launch-floating-terminal-with-presentation ai-usagebar-tui\")","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-e86b0ed70f4c","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"omarchy/Model.js","line":67,"snippet":"","message":"Function Call Object Injection Sink","category":"exec","hardFail":false},{"id":"F-be7b5765d0ec","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"omarchy/Model.js","line":80,"snippet":"","message":"Function Call Object Injection Sink","category":"exec","hardFail":false},{"id":"F-0974aa518f8a","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"omarchy/Model.js","line":104,"snippet":"","message":"Function Call Object Injection Sink","category":"exec","hardFail":false},{"id":"F-b72f3a052d3a","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"omarchy/Model.js","line":139,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-3cf613458626","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"omarchy/Model.js","line":148,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-71cea425a4ce","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"omarchy/Model.js","line":150,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-7ed1930db497","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"omarchy/Model.js","line":159,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-8198556bb377","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"omarchy/Model.js","line":173,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-e71be520bbdb","source":"eslint","ruleId":"r.440b465c2d7c","severity":"info","confidence":0.6,"path":"omarchy/Model.js","line":218,"snippet":"","message":"Unsafe Regular Expression","category":"exec","hardFail":false},{"id":"F-7ae2caa31397","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"omarchy/Model.js","line":247,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-18f5e2f07f7b","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"omarchy/Model.js","line":255,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-57eb843109f6","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"omarchy/Model.js","line":272,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-a69b8f0c1a14","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"omarchy/Model.js","line":293,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-abc7e08013f2","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"omarchy/Model.js","line":299,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-c59bd910d885","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"omarchy/Model.js","line":304,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-0b98935aa7bd","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"omarchy/Panel.qml","line":128,"snippet":"bar.run(\"omarchy-launch-floating-terminal-with-presentation ai-usagebar-tui\")","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-a221d57df5e5","source":"opengrep","ruleId":"r.773ca74ce5dc","severity":"info","confidence":0.9,"path":"omarchy/Panel.qml","line":204,"snippet":"Process {","message":"Quickshell Process — spawns external programs.","category":"exec","hardFail":false},{"id":"F-9df0e6be422e","source":"extcode","ruleId":"r.5b0c49abe65e","severity":"medium","confidence":0.8,"path":"omarchy/Panel.qml","line":207,"snippet":"command: [\"ai-usagebar\", \"usage\", \"--json\"]","message":"Runs 'ai-usagebar', which is not in the repository or the Omarchy base install: its code was not reviewed (installed separately, e.g. from the AUR).","category":"external-code","hardFail":false},{"id":"F-aecc17b41ba0","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"omarchy/README.md","line":18,"snippet":"omarchy pkg aur add ai-usagebar-bin","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-f0041a8ff853","source":"opengrep","ruleId":"r.77dfe677dff7","severity":"info","confidence":0.9,"path":"omarchy/README.md","line":18,"snippet":"omarchy pkg aur add ai-usagebar-bin","message":"Installs system packages (pacman / AUR helper / omarchy pkg).","category":"package","hardFail":false},{"id":"F-edcce107df19","source":"textscan","ruleId":"r.f93d25679c59","severity":"info","confidence":1.0,"path":"omarchy/README.md","line":18,"snippet":"omarchy pkg aur add ai-usagebar-bin","message":"System package referenced for install: ai-usagebar-bin (aur)","category":"package","hardFail":false},{"id":"F-21b9a5ced88d","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"omarchy/README.md","line":19,"snippet":"omarchy plugin add https://github.com/akitaonrails/ai-usagebar.git --enable","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-13533d421c17","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"omarchy/README.md","line":22,"snippet":"Omarchy clones plugin repositories into `~/.config/omarchy/plugins/`. The root","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-fc45004faf27","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"omarchy/README.md","line":28,"snippet":"omarchy plugin update akitaonrails.ai-usagebar","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-57875277e81b","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"omarchy/README.md","line":29,"snippet":"omarchy plugin remove akitaonrails.ai-usagebar","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-b2be94187944","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"omarchy/README.md","line":39,"snippet":"- Shell: `omarchy-shell shell summon akitaonrails.ai-usagebar '{}'` opens the","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-04d0b3f60a29","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"omarchy/README.md","line":40,"snippet":"panel and `omarchy-shell shell hide akitaonrails.ai-usagebar` closes it.","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-f01e868bcf12","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"omarchy/README.md","line":64,"snippet":"The plugin's display-only options remain in `~/.config/omarchy/shell.json` and","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-127c2ec2f3b3","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"omarchy/README.md","line":88,"snippet":"omarchy plugin validate .","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-7226c8b0a027","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"omarchy/README.md","line":89,"snippet":"qmllint -U -I /usr/share/omarchy/shell omarchy/BarWidget.qml omarchy/Panel.qml omarchy/SettingsView.qml","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-64d9fb544f60","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"omarchy/README.md","line":94,"snippet":"reload. In a source checkout, rerun `omarchy plugin validate .` after changing","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-b822db682cf8","source":"opengrep","ruleId":"r.773ca74ce5dc","severity":"info","confidence":0.9,"path":"omarchy/SettingsView.qml","line":139,"snippet":"Process {","message":"Quickshell Process — spawns external programs.","category":"exec","hardFail":false},{"id":"F-a699d00a7837","source":"opengrep","ruleId":"r.773ca74ce5dc","severity":"info","confidence":0.9,"path":"omarchy/SettingsView.qml","line":158,"snippet":"Process {","message":"Quickshell Process — spawns external programs.","category":"exec","hardFail":false},{"id":"F-cc336e1bead4","source":"ai","ruleId":"r.3ced4e1cd7e6","severity":"low","confidence":0.6,"path":"omarchy/SettingsView.qml","line":161,"snippet":"command: [\"ai-usagebar\", \"settings\", \"apply\"]","message":"Settings apply passes API keys to the external ai-usagebar CLI, which is not reviewed.","category":"secret","hardFail":false},{"id":"F-76623e92ec9f","source":"malcontent","ruleId":"r.98f4a8002aa3","severity":"info","confidence":0.6,"path":"omarchy/model.test.mjs","line":0,"snippet":"['line spoofright-to-left', 'nspoof']","message":"references spoofing [MEDIUM]","category":"other","hardFail":false},{"id":"F-1a10da801101","source":"eslint","ruleId":"r.91ce6a8cb27c","severity":"info","confidence":0.6,"path":"omarchy/model.test.mjs","line":5,"snippet":"","message":"Found readFileSync from package \"node:fs\" with non literal argument at index 0","category":"exec","hardFail":false},{"id":"F-82a74b4294b2","source":"eslint","ruleId":"r.91ce6a8cb27c","severity":"info","confidence":0.6,"path":"omarchy/model.test.mjs","line":13,"snippet":"","message":"Found readFileSync from package \"node:fs\" with non literal argument at index 0","category":"exec","hardFail":false},{"id":"F-845535df4c54","source":"eslint","ruleId":"r.91ce6a8cb27c","severity":"info","confidence":0.6,"path":"omarchy/model.test.mjs","line":17,"snippet":"","message":"Found readFileSync from package \"node:fs\" with non literal argument at index 0","category":"exec","hardFail":false},{"id":"F-1d490e875e82","source":"eslint","ruleId":"r.a119b15bdcd5","severity":"info","confidence":0.6,"path":"omarchy/model.test.mjs","line":20,"snippet":"","message":"Found non-literal argument to RegExp Constructor","category":"exec","hardFail":false},{"id":"F-1193b5e6c0ec","source":"eslint","ruleId":"r.91ce6a8cb27c","severity":"info","confidence":0.6,"path":"omarchy/model.test.mjs","line":26,"snippet":"","message":"Found readFileSync from package \"node:fs\" with non literal argument at index 0","category":"exec","hardFail":false},{"id":"F-e5b9124d8c8a","source":"eslint","ruleId":"r.91ce6a8cb27c","severity":"info","confidence":0.6,"path":"omarchy/model.test.mjs","line":33,"snippet":"","message":"Found readFileSync from package \"node:fs\" with non literal argument at index 0","category":"exec","hardFail":false},{"id":"F-d8ce6ffbb2d3","source":"opengrep","ruleId":"r.cce82e3e2863","severity":"info","confidence":0.9,"path":"packaging/aur/PKGBUILD-bin","line":26,"snippet":"# Per-arch sources — pacman picks the matching one for the host arch.","message":"Uses pacman / AUR helpers.","category":"other","hardFail":false},{"id":"F-f48c5368be63","source":"malcontent","ruleId":"r.61ca01356bc1","severity":"info","confidence":0.6,"path":"src/account.rs","line":0,"snippet":"['Keychain']","message":"accesses a keychain [MEDIUM]","category":"other","hardFail":false},{"id":"F-818edc76cd12","source":"malcontent","ruleId":"r.8a2d19128690","severity":"info","confidence":0.6,"path":"src/account.rs","line":0,"snippet":"['/accounts/work/.credentials.json']","message":"possible hidden file path [MEDIUM]","category":"other","hardFail":false},{"id":"F-c5d9678e159c","source":"malcontent","ruleId":"r.a5934ed7d04a","severity":"info","confidence":0.6,"path":"src/account.rs","line":0,"snippet":"['subprocess']","message":"execute external program [MEDIUM]","category":"other","hardFail":false},{"id":"F-2ac25c294c6d","source":"malcontent","ruleId":"r.1ede94bd4987","severity":"info","confidence":0.6,"path":"src/account.rs","line":0,"snippet":"['cookies']","message":"may access cookies [MEDIUM]","category":"other","hardFail":false},{"id":"F-746e3f367049","source":"malcontent","ruleId":"r.f096078dc3a9","severity":"info","confidence":0.6,"path":"src/account.rs","line":0,"snippet":"['/tmp/Claude']","message":"path reference within /tmp [MEDIUM]","category":"other","hardFail":false},{"id":"F-ce2f1a94e20e","source":"malcontent","ruleId":"r.61ca01356bc1","severity":"info","confidence":0.6,"path":"src/anthropic/cli_account.rs","line":0,"snippet":"['Keychain', 'keychain']","message":"accesses a keychain [MEDIUM]","category":"other","hardFail":false},{"id":"F-9add164fc0f8","source":"malcontent","ruleId":"r.f096078dc3a9","severity":"info","confidence":0.6,"path":"src/anthropic/cli_account.rs","line":0,"snippet":"['/tmp/x']","message":"references an unusual path within /tmp [MEDIUM]","category":"other","hardFail":false},{"id":"F-8e9e8fcef0ae","source":"malcontent","ruleId":"r.61ca01356bc1","severity":"info","confidence":0.6,"path":"src/anthropic/creds.rs","line":0,"snippet":"['Keychain', 'keychain']","message":"accesses a keychain [MEDIUM]","category":"other","hardFail":false},{"id":"F-f58f073d0a4a","source":"malcontent","ruleId":"r.e60d04e04200","severity":"info","confidence":0.6,"path":"src/anthropic/creds.rs","line":0,"snippet":"['USERPROFILE', 'Desktop']","message":"Looks up the Desktop directory for the current user [MEDIUM]","category":"other","hardFail":false},{"id":"F-ee79901b5a98","source":"malcontent","ruleId":"r.a5934ed7d04a","severity":"info","confidence":0.6,"path":"src/anthropic/creds.rs","line":0,"snippet":"['subprocess']","message":"execute external program [MEDIUM]","category":"other","hardFail":false},{"id":"F-c37cbae2b009","source":"malcontent","ruleId":"r.ef1ffca5d1bd","severity":"info","confidence":0.6,"path":"src/anthropic/desktop_creds.rs","line":0,"snippet":"['clientId']","message":"contains a client ID [MEDIUM]","category":"other","hardFail":false},{"id":"F-e375c0126ba3","source":"malcontent","ruleId":"r.61ca01356bc1","severity":"info","confidence":0.6,"path":"src/anthropic/desktop_creds.rs","line":0,"snippet":"['Keychain']","message":"accesses a keychain [MEDIUM]","category":"other","hardFail":false},{"id":"F-86f7e0a23232","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/anthropic/desktop_creds.rs","line":363,"snippet":"\"9d1c250a:org:https://api.anthropic.com:user:inference user:profile\": {","message":"URL literal: https://api.anthropic.com","category":"network","hardFail":false},{"id":"F-f22bb73bd7cf","source":"malcontent","ruleId":"r.61ca01356bc1","severity":"info","confidence":0.6,"path":"src/anthropic/fetch.rs","line":0,"snippet":"['Keychain']","message":"accesses a keychain [MEDIUM]","category":"other","hardFail":false},{"id":"F-7cc12b4a0b1d","source":"malcontent","ruleId":"r.8d917b297212","severity":"info","confidence":0.6,"path":"src/anthropic/fetch.rs","line":0,"snippet":"['application/json', 'POST']","message":"upload content via HTTP form [MEDIUM]","category":"other","hardFail":false},{"id":"F-da38207799d7","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"src/anthropic/fetch.rs","line":0,"snippet":"['Content-Type', 'HTTP', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-087638c52926","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/anthropic/fetch.rs","line":17,"snippet":"pub const USAGE_URL: &str = \"https://api.anthropic.com/api/oauth/usage\";","message":"URL literal: https://api.anthropic.com","category":"network","hardFail":false},{"id":"F-d6ca150091a1","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/anthropic/fetch.rs","line":436,"snippet":"usage: \"http://localhost:1/should-not-be-called\".into(),","message":"URL literal: http://localhost","category":"network","hardFail":false},{"id":"F-8a091eab6eac","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/anthropic/fetch.rs","line":616,"snippet":"usage: \"http://127.0.0.1:1/api/oauth/usage\".into(),","message":"URL literal: http://127.0.0.1","category":"network","hardFail":false},{"id":"F-ae677f521f5f","source":"malcontent","ruleId":"r.61ca01356bc1","severity":"low","confidence":0.6,"path":"src/anthropic/keychain.rs","line":0,"snippet":"['find-generic-password']","message":"Looks up a password from the Keychain [HIGH]","category":"other","hardFail":false},{"id":"F-75239c39b67a","source":"malcontent","ruleId":"r.1efae2d4d298","severity":"info","confidence":0.6,"path":"src/anthropic/keychain.rs","line":0,"snippet":"['/bin/sh']","message":"executes shell [MEDIUM]","category":"other","hardFail":false},{"id":"F-f3883a78d4fd","source":"malcontent","ruleId":"r.61ca01356bc1","severity":"info","confidence":0.6,"path":"src/anthropic/mod.rs","line":0,"snippet":"['keychain']","message":"accesses a keychain [MEDIUM]","category":"other","hardFail":false},{"id":"F-bc2cc5406151","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/anthropic/mod.rs","line":2,"snippet":"//! `https://api.anthropic.com/api/oauth/usage` endpoint.","message":"URL literal: https://api.anthropic.com","category":"network","hardFail":false},{"id":"F-eaa2b5241a0a","source":"malcontent","ruleId":"r.ef1ffca5d1bd","severity":"info","confidence":0.6,"path":"src/anthropic/oauth.rs","line":0,"snippet":"['client_id']","message":"contains a client ID [MEDIUM]","category":"other","hardFail":false},{"id":"F-132cb049ba0d","source":"malcontent","ruleId":"r.8d917b297212","severity":"info","confidence":0.6,"path":"src/anthropic/oauth.rs","line":0,"snippet":"['application/json', 'POST', 'post']","message":"upload content via HTTP form [MEDIUM]","category":"other","hardFail":false},{"id":"F-8e9eb76e4d0b","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"src/anthropic/oauth.rs","line":0,"snippet":"['Content-Type', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-fd781f6473a6","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/anthropic/oauth.rs","line":1,"snippet":"//! OAuth token refresh — POST `https://platform.claude.com/v1/oauth/token`.","message":"URL literal: https://platform.claude.com","category":"network","hardFail":false},{"id":"F-eaabed1238d0","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/anthropic_api/fetch.rs","line":20,"snippet":"pub const BASE_URL: &str = \"https://api.anthropic.com\";","message":"URL literal: https://api.anthropic.com","category":"network","hardFail":false},{"id":"F-81cd713f7de8","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/anthropic_api/types.rs","line":5,"snippet":"//! (<https://platform.claude.com/docs/en/api/admin-api/usage-cost/get-cost-report>):","message":"URL literal: https://platform.claude.com","category":"network","hardFail":false},{"id":"F-0e45e651d1b3","source":"malcontent","ruleId":"r.23a5406365c9","severity":"info","confidence":0.6,"path":"src/antigravity/fetch.rs","line":0,"snippet":"['https://', 'http://', 'windows', 'Linux', 'linux', 'macOS', 'macos']","message":"references multiple operating systems [MEDIUM]","category":"other","hardFail":false},{"id":"F-c39b196c4751","source":"malcontent","ruleId":"r.98f35183c638","severity":"info","confidence":0.6,"path":"src/antigravity/fetch.rs","line":0,"snippet":"['sshd']","message":"Mentions SSHD [MEDIUM]","category":"other","hardFail":false},{"id":"F-83585808284c","source":"malcontent","ruleId":"r.8a2d19128690","severity":"info","confidence":0.6,"path":"src/antigravity/fetch.rs","line":0,"snippet":"['/home/u/.local']","message":"possible hidden file path [MEDIUM]","category":"other","hardFail":false},{"id":"F-d0d6e658e99f","source":"malcontent","ruleId":"r.8d917b297212","severity":"info","confidence":0.6,"path":"src/antigravity/fetch.rs","line":0,"snippet":"['application/json', 'POST', 'post']","message":"upload content via HTTP form [MEDIUM]","category":"other","hardFail":false},{"id":"F-3b096104e762","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"src/antigravity/fetch.rs","line":0,"snippet":"['Content-Type', 'HTTP', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-b4cd98d07854","source":"malcontent","ruleId":"r.57128783ca37","severity":"info","confidence":0.6,"path":"src/antigravity/fetch.rs","line":0,"snippet":"['host:port']","message":"connects to an arbitrary host:port [MEDIUM]","category":"other","hardFail":false},{"id":"F-7c87b8dabbd2","source":"malcontent","ruleId":"r.c6ece59a0429","severity":"info","confidence":0.6,"path":"src/antigravity/fetch.rs","line":0,"snippet":"['listen', 'socket']","message":"listen on a socket [MEDIUM]","category":"other","hardFail":false},{"id":"F-937370506d28","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/antigravity/fetch.rs","line":403,"snippet":".map(|p| format!(\"http://127.0.0.1:{p}\"))","message":"URL literal: http://127.0.0.1","category":"network","hardFail":false},{"id":"F-0ab9336a0286","source":"malcontent","ruleId":"r.5dc13594e86f","severity":"low","confidence":0.6,"path":"src/cache.rs","line":0,"snippet":"['yload_refuses_a_payload_older_than_the_', 'fallback_payload_refuses_a_paylo', 'maybe_payload_returns_none_wh', 'fresh_payload_respects_ttl', 'write_payload', 'payload_path', 'read_payload', 'payload","message":"payload path [HIGH]","category":"other","hardFail":false},{"id":"F-8682a705fe92","source":"malcontent","ruleId":"r.22759d69cf4f","severity":"info","confidence":0.6,"path":"src/claude_desktop/app.rs","line":0,"snippet":"['LevelDB']","message":"accesses LevelDB databases [MEDIUM]","category":"other","hardFail":false},{"id":"F-5728dc834e53","source":"malcontent","ruleId":"r.61ca01356bc1","severity":"info","confidence":0.6,"path":"src/claude_desktop/app.rs","line":0,"snippet":"['keychain']","message":"accesses a keychain [MEDIUM]","category":"other","hardFail":false},{"id":"F-170dbda97af6","source":"malcontent","ruleId":"r.7aa644c08f09","severity":"info","confidence":0.6,"path":"src/claude_desktop/app.rs","line":0,"snippet":"['pgrep']","message":"Finds program in process table [MEDIUM]","category":"other","hardFail":false},{"id":"F-511a289fe523","source":"malcontent","ruleId":"r.ee82497fc5a2","severity":"info","confidence":0.6,"path":"src/claude_desktop/app.rs","line":0,"snippet":"['osascript']","message":"runs osascript [MEDIUM]","category":"other","hardFail":false},{"id":"F-91755fc2c882","source":"malcontent","ruleId":"r.73ac774929b3","severity":"info","confidence":0.6,"path":"src/claude_desktop/app.rs","line":0,"snippet":"['/usr/bin/open', '/usr/bin/tar']","message":"can call /usr/bin/open and archiving tools [MEDIUM]","category":"other","hardFail":false},{"id":"F-f1a2e1d98f20","source":"malcontent","ruleId":"r.1ede94bd4987","severity":"info","confidence":0.6,"path":"src/claude_desktop/app.rs","line":0,"snippet":"['cookies']","message":"may access cookies [MEDIUM]","category":"other","hardFail":false},{"id":"F-d6e1aced3979","source":"malcontent","ruleId":"r.4ed500835adc","severity":"info","confidence":0.6,"path":"src/claude_desktop/app.rs","line":0,"snippet":"['/Applications/Claude.app/Contents/MacOS/Claude']","message":"references hardcoded application path [MEDIUM]","category":"other","hardFail":false},{"id":"F-563d405087f8","source":"malcontent","ruleId":"r.bd0dc86cbeb5","severity":"info","confidence":0.6,"path":"src/claude_desktop/app.rs","line":0,"snippet":"['chmod']","message":"modifies file permissions [MEDIUM]","category":"other","hardFail":false},{"id":"F-089674109c29","source":"malcontent","ruleId":"r.22759d69cf4f","severity":"info","confidence":0.6,"path":"src/claude_desktop/capture.rs","line":0,"snippet":"['leveldb']","message":"accesses LevelDB databases [MEDIUM]","category":"other","hardFail":false},{"id":"F-0879f89d266a","source":"malcontent","ruleId":"r.1ede94bd4987","severity":"info","confidence":0.6,"path":"src/claude_desktop/capture.rs","line":0,"snippet":"['Cookies', 'cookies']","message":"may access cookies [MEDIUM]","category":"other","hardFail":false},{"id":"F-c24230d60b6b","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/claude_desktop/capture.rs","line":16,"snippet":"//! Ported from claude-acc's `add` (<https://github.com/ohmaseclaro/claude-acc>),","message":"URL literal: https://github.com","category":"network","hardFail":false},{"id":"F-c4d37814cde6","source":"malcontent","ruleId":"r.f096078dc3a9","severity":"info","confidence":0.6,"path":"src/claude_desktop/merge.rs","line":0,"snippet":"['/tmp/demo']","message":"path reference within /tmp [MEDIUM]","category":"other","hardFail":false},{"id":"F-4e258daa1117","source":"malcontent","ruleId":"r.22759d69cf4f","severity":"info","confidence":0.6,"path":"src/claude_desktop/mod.rs","line":0,"snippet":"['LEVELDB_DIRS', 'LevelDB', 'leveldb']","message":"accesses LevelDB databases [MEDIUM]","category":"other","hardFail":false},{"id":"F-c538adb0aeeb","source":"malcontent","ruleId":"r.1ede94bd4987","severity":"info","confidence":0.6,"path":"src/claude_desktop/mod.rs","line":0,"snippet":"['Cookies', 'cookies']","message":"may access cookies [MEDIUM]","category":"other","hardFail":false},{"id":"F-cefe99a2ef6a","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/claude_desktop/mod.rs","line":10,"snippet":"//! reverse-engineered by **claude-acc** (<https://github.com/ohmaseclaro/claude-acc>,","message":"URL literal: https://github.com","category":"network","hardFail":false},{"id":"F-a655b233b874","source":"malcontent","ruleId":"r.23a5406365c9","severity":"info","confidence":0.6,"path":"src/config.rs","line":0,"snippet":"['https://', 'Windows', 'windows', 'Linux', 'macOS']","message":"references multiple operating systems [MEDIUM]","category":"other","hardFail":false},{"id":"F-05963d02fa8f","source":"malcontent","ruleId":"r.28ce290c9d3f","severity":"info","confidence":0.6,"path":"src/config.rs","line":0,"snippet":"['sqlite3']","message":"accesses SQLite databases [MEDIUM]","category":"other","hardFail":false},{"id":"F-1e03bed24b45","source":"malcontent","ruleId":"r.61ca01356bc1","severity":"info","confidence":0.6,"path":"src/config.rs","line":0,"snippet":"['Keychain', 'keychain']","message":"accesses a keychain [MEDIUM]","category":"other","hardFail":false},{"id":"F-322732ac8f2f","source":"malcontent","ruleId":"r.8a2d19128690","severity":"info","confidence":0.6,"path":"src/config.rs","line":0,"snippet":"['/tmp/accounts/personal/.credentials.json', '/tmp/accounts/work/.credentials.json', '/other/.credentials.json', '/home/u/.config']","message":"possible hidden file path [MEDIUM]","category":"other","hardFail":false},{"id":"F-d4bc81cff6da","source":"malcontent","ruleId":"r.25aa09c9f7e1","severity":"info","confidence":0.6,"path":"src/config.rs","line":0,"snippet":"['/etc/hosts']","message":"references /etc/hosts [MEDIUM]","category":"other","hardFail":false},{"id":"F-d3ebd6ff733b","source":"malcontent","ruleId":"r.f096078dc3a9","severity":"info","confidence":0.6,"path":"src/config.rs","line":0,"snippet":"['/tmp/accounts/personal/.credentials.json', '/tmp/accounts/work/.credentials.json', '/tmp/does-not-exist-ai-usagebar-test']","message":"path reference within /tmp [MEDIUM]","category":"other","hardFail":false},{"id":"F-bdf77c36d563","source":"malcontent","ruleId":"r.d5d304b1ed90","severity":"info","confidence":0.6,"path":"src/config.rs","line":0,"snippet":"['/Users/me']","message":"references path within /Users [MEDIUM]","category":"other","hardFail":false},{"id":"F-30206f1a32c3","source":"malcontent","ruleId":"r.bd0dc86cbeb5","severity":"info","confidence":0.6,"path":"src/config.rs","line":0,"snippet":"['Chmod']","message":"modifies file permissions [MEDIUM]","category":"other","hardFail":false},{"id":"F-6dafe8c2fb28","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"src/config.rs","line":0,"snippet":"['agent_auth_path', 'default_agent', 'cursor_agent']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-b1acc5717c6b","source":"malcontent","ruleId":"r.98f4a8002aa3","severity":"info","confidence":0.6,"path":"src/config.rs","line":0,"snippet":"['spoof terminal output']","message":"references spoofing [MEDIUM]","category":"other","hardFail":false},{"id":"F-9ffd4dbd7a0e","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/config.rs","line":181,"snippet":"/// (<https://github.com/ohmaseclaro/claude-acc>) creates — `account switch`","message":"URL literal: https://github.com","category":"network","hardFail":false},{"id":"F-ad597efba944","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"src/context/mod.rs","line":0,"snippet":"['Subagent', 'subagent']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-e74909757302","source":"malcontent","ruleId":"r.21649a357848","severity":"info","confidence":0.6,"path":"src/cursor/db.rs","line":0,"snippet":"['base64_shell_encode::| base64']","message":"calls base64 command to encode strings [MEDIUM]","category":"other","hardFail":false},{"id":"F-038b06d6d13c","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"src/cursor/db.rs","line":0,"snippet":"['ide_db_with_the_agent', 'agent_access_token', 'surfaces_the_agent', 'back_to_the_agent', 'agent_auth_path', 'default_agent', 'agent_file', 'agent_path', 'read_agent']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-42a001dd853c","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"src/cursor/fetch.rs","line":0,"snippet":"['agent_auth_path', 'agent_path', 'no_agent']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-222d9220f8f2","source":"malcontent","ruleId":"r.35e4fb839116","severity":"info","confidence":0.6,"path":"src/cursor/fetch.rs","line":0,"snippet":"['Cookie', 'HTTP']","message":"access HTTP resources using cookies [MEDIUM]","category":"other","hardFail":false},{"id":"F-56de39695316","source":"malcontent","ruleId":"r.0f11e0c0e16d","severity":"info","confidence":0.6,"path":"src/cursor/fetch.rs","line":0,"snippet":"['(KHTML, like Gecko) Chrome']","message":"pretends to be Chrome [MEDIUM]","category":"other","hardFail":false},{"id":"F-7eb827f40213","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/cursor/fetch.rs","line":18,"snippet":"pub const BASE_URL: &str = \"https://cursor.com\";","message":"URL literal: https://cursor.com","category":"network","hardFail":false},{"id":"F-3c53cbef219c","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/deepseek/fetch.rs","line":11,"snippet":"pub const BASE_URL: &str = \"https://api.deepseek.com\";","message":"URL literal: https://api.deepseek.com","category":"network","hardFail":false},{"id":"F-0a12680ce3fb","source":"malcontent","ruleId":"r.98f4a8002aa3","severity":"info","confidence":0.6,"path":"src/display.rs","line":0,"snippet":"['column returnspoof']","message":"references spoofing [MEDIUM]","category":"other","hardFail":false},{"id":"F-e961224e2a20","source":"malcontent","ruleId":"r.33e4b7993b69","severity":"info","confidence":0.6,"path":"src/error.rs","line":0,"snippet":"['connect']","message":"initiate a connection on a socket [MEDIUM]","category":"other","hardFail":false},{"id":"F-06d2d33a0c66","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/grok/fetch.rs","line":15,"snippet":"pub const BASE_URL: &str = \"https://management-api.x.ai\";","message":"URL literal: https://management-api.x.ai","category":"network","hardFail":false},{"id":"F-2a44186da8d4","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/grok/types.rs","line":4,"snippet":"//! (<https://docs.x.ai/developers/rest-api-reference/management/billing>):","message":"URL literal: https://docs.x.ai","category":"network","hardFail":false},{"id":"F-09911851043b","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/kilo/fetch.rs","line":15,"snippet":"pub const BASE_URL: &str = \"https://api.kilo.ai\";","message":"URL literal: https://api.kilo.ai","category":"network","hardFail":false},{"id":"F-c3b408bb9d68","source":"malcontent","ruleId":"r.5dc13594e86f","severity":"low","confidence":0.6,"path":"src/kimi/fetch.rs","line":0,"snippet":"['fallback_payload', 'fresh_payload', 'write_payload', 'payload_path', 'payload_age']","message":"payload path [HIGH]","category":"other","hardFail":false},{"id":"F-effa5afcaaf4","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/kimi/fetch.rs","line":13,"snippet":"pub const BASE_URL: &str = \"https://api.kimi.com\";","message":"URL literal: https://api.kimi.com","category":"network","hardFail":false},{"id":"F-073bf0768593","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/kimi/fetch.rs","line":540,"snippet":"usages: \"http://localhost:1/coding/v1/usages\".into(),","message":"URL literal: http://localhost","category":"network","hardFail":false},{"id":"F-3a92320e79a9","source":"malcontent","ruleId":"r.ef1ffca5d1bd","severity":"info","confidence":0.6,"path":"src/kiro/db.rs","line":0,"snippet":"['client_id']","message":"contains a client ID [MEDIUM]","category":"other","hardFail":false},{"id":"F-4c5c9cede7a0","source":"malcontent","ruleId":"r.28ce290c9d3f","severity":"info","confidence":0.6,"path":"src/kiro/db.rs","line":0,"snippet":"['sqlite3']","message":"accesses SQLite databases [MEDIUM]","category":"other","hardFail":false},{"id":"F-c1b535e8d273","source":"gitleaks","ruleId":"r.43cd6c2d96bb","severity":"low","confidence":0.7,"path":"src/kiro/db.rs","line":400,"snippet":"one.account_key, \"RED…REDACTED\"","message":"Possible hard-coded secret (Detected a Generic API Key, potentially exposing access to various services and sensitive operations.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-0038af606c49","source":"malcontent","ruleId":"r.ef1ffca5d1bd","severity":"info","confidence":0.6,"path":"src/kiro/fetch.rs","line":0,"snippet":"['client_id', 'clientId']","message":"contains a client ID [MEDIUM]","category":"other","hardFail":false},{"id":"F-e0659f9b833b","source":"malcontent","ruleId":"r.28ce290c9d3f","severity":"info","confidence":0.6,"path":"src/kiro/fetch.rs","line":0,"snippet":"['sqlite3']","message":"accesses SQLite databases [MEDIUM]","category":"other","hardFail":false},{"id":"F-ccb05fef89f3","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"src/kiro/fetch.rs","line":0,"snippet":"['Content-Type', 'HTTP', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-a7e3b21d7a0a","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/kiro/fetch.rs","line":750,"snippet":"// \"http://127.0.0.1:1\" endpoint is a canary — the test would fail","message":"URL literal: http://127.0.0.1","category":"network","hardFail":false},{"id":"F-0a5578eb13a3","source":"malcontent","ruleId":"r.ef1ffca5d1bd","severity":"info","confidence":0.6,"path":"src/kiro/oauth.rs","line":0,"snippet":"['client_id', 'clientId']","message":"contains a client ID [MEDIUM]","category":"other","hardFail":false},{"id":"F-2556566f0935","source":"malcontent","ruleId":"r.8d917b297212","severity":"info","confidence":0.6,"path":"src/kiro/oauth.rs","line":0,"snippet":"['application/json', 'POST', 'post']","message":"upload content via HTTP form [MEDIUM]","category":"other","hardFail":false},{"id":"F-99bd2006aea2","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"src/kiro/oauth.rs","line":0,"snippet":"['Content-Type', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-4547a43ec67d","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/kiro/oauth.rs","line":3,"snippet":"//! <https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/API_CreateToken.html>),","message":"URL literal: https://docs.aws.amazon.com","category":"network","hardFail":false},{"id":"F-296258cdfe95","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/kiro/oauth.rs","line":171,"snippet":"\"https://oidc.us-east-1.amazonaws.com/token\"","message":"URL literal: https://oidc.us-east-1.amazonaws.com","category":"network","hardFail":false},{"id":"F-b46ac015dac3","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/kiro/oauth.rs","line":175,"snippet":"\"https://oidc.us-gov-west-1.amazonaws.com/token\"","message":"URL literal: https://oidc.us-gov-west-1.amazonaws.com","category":"network","hardFail":false},{"id":"F-4a87ce20b8a1","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/kiro/types.rs","line":6,"snippet":"//! `https://codewhisperer.us-east-1.amazonaws.com/` with `x-amz-target:","message":"URL literal: https://codewhisperer.us-east-1.amazonaws.com","category":"network","hardFail":false},{"id":"F-d909d464fbfe","source":"malcontent","ruleId":"r.5dc13594e86f","severity":"low","confidence":0.6,"path":"src/minimax/fetch.rs","line":0,"snippet":"['fallback_payload', 'fresh_payload', 'write_payload', 'payload_path', 'payload_age']","message":"payload path [HIGH]","category":"other","hardFail":false},{"id":"F-8021c84c7aa7","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/minimax/fetch.rs","line":19,"snippet":"pub const BASE_GLOBAL: &str = \"https://api.minimax.io\";","message":"URL literal: https://api.minimax.io","category":"network","hardFail":false},{"id":"F-8d3aeccfabfc","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/minimax/fetch.rs","line":20,"snippet":"pub const BASE_CN: &str = \"https://api.minimaxi.com\";","message":"URL literal: https://api.minimaxi.com","category":"network","hardFail":false},{"id":"F-e218c2244502","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/moonshot/fetch.rs","line":15,"snippet":"pub const BASE_GLOBAL: &str = \"https://api.moonshot.ai\";","message":"URL literal: https://api.moonshot.ai","category":"network","hardFail":false},{"id":"F-ca6a03f7195b","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/moonshot/fetch.rs","line":16,"snippet":"pub const BASE_CN: &str = \"https://api.moonshot.cn\";","message":"URL literal: https://api.moonshot.cn","category":"network","hardFail":false},{"id":"F-a63a94cd6564","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/novita/fetch.rs","line":14,"snippet":"pub const BASE_URL: &str = \"https://api.novita.ai\";","message":"URL literal: https://api.novita.ai","category":"network","hardFail":false},{"id":"F-7bb1d950fcc8","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/novita/types.rs","line":4,"snippet":"//! (<https://novita.ai/docs/api-reference/basic-get-user-balance>): every","message":"URL literal: https://novita.ai","category":"network","hardFail":false},{"id":"F-b3904d868f11","source":"malcontent","ruleId":"r.23a5406365c9","severity":"info","confidence":0.6,"path":"src/openai/creds.rs","line":0,"snippet":"['https://', 'Windows', 'windows', 'macOS']","message":"references multiple operating systems [MEDIUM]","category":"other","hardFail":false},{"id":"F-650834d88ab7","source":"malcontent","ruleId":"r.21649a357848","severity":"info","confidence":0.6,"path":"src/openai/creds.rs","line":0,"snippet":"['base64_shell_encode::| base64']","message":"calls base64 command to encode strings [MEDIUM]","category":"other","hardFail":false},{"id":"F-be6f222a6b48","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/openai/creds.rs","line":80,"snippet":"/// `https://api.openai.com/auth.chatgpt_plan_type`.","message":"URL literal: https://api.openai.com","category":"network","hardFail":false},{"id":"F-d832236ecba3","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/openai/fetch.rs","line":18,"snippet":"pub const USAGE_URL: &str = \"https://chatgpt.com/backend-api/wham/usage\";","message":"URL literal: https://chatgpt.com","category":"network","hardFail":false},{"id":"F-7a37082e4fd2","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/openai/fetch.rs","line":262,"snippet":"\"https://api.openai.com/auth\": {\"chatgpt_plan_type\": \"plus\"}","message":"URL literal: https://api.openai.com","category":"network","hardFail":false},{"id":"F-52e464ee056a","source":"malcontent","ruleId":"r.ef1ffca5d1bd","severity":"info","confidence":0.6,"path":"src/openai/oauth.rs","line":0,"snippet":"['client_id']","message":"contains a client ID [MEDIUM]","category":"other","hardFail":false},{"id":"F-79585209b836","source":"malcontent","ruleId":"r.8d917b297212","severity":"info","confidence":0.6,"path":"src/openai/oauth.rs","line":0,"snippet":"['application/json', 'POST', 'post']","message":"upload content via HTTP form [MEDIUM]","category":"other","hardFail":false},{"id":"F-7f90282d221c","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"src/openai/oauth.rs","line":0,"snippet":"['Content-Type', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-4621f01e66d1","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/openai/oauth.rs","line":1,"snippet":"//! OAuth refresh — POST `https://auth.openai.com/oauth/token`.","message":"URL literal: https://auth.openai.com","category":"network","hardFail":false},{"id":"F-b952226f2b9f","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/openai/types.rs","line":1,"snippet":"//! Wire types for `GET https://chatgpt.com/backend-api/wham/usage`.","message":"URL literal: https://chatgpt.com","category":"network","hardFail":false},{"id":"F-e3518096a36e","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/openrouter/fetch.rs","line":12,"snippet":"pub const BASE_URL: &str = \"https://openrouter.ai/api/v1\";","message":"URL literal: https://openrouter.ai","category":"network","hardFail":false},{"id":"F-02b09a97aa76","source":"malcontent","ruleId":"r.98f4a8002aa3","severity":"info","confidence":0.6,"path":"src/openrouter/vendor.rs","line":0,"snippet":"['spoof']","message":"references spoofing [MEDIUM]","category":"other","hardFail":false},{"id":"F-7151fba09fd5","source":"malcontent","ruleId":"r.61ca01356bc1","severity":"low","confidence":0.6,"path":"src/safe_storage.rs","line":0,"snippet":"['find-generic-password']","message":"Looks up a password from the Keychain [HIGH]","category":"other","hardFail":false},{"id":"F-6038145f0958","source":"malcontent","ruleId":"r.6f995e4f75aa","severity":"info","confidence":0.6,"path":"src/safe_storage.rs","line":0,"snippet":"['ciphertext']","message":"mentions 'ciphertext' [MEDIUM]","category":"other","hardFail":false},{"id":"F-78ce901aa63b","source":"malcontent","ruleId":"r.76acf10b43f4","severity":"info","confidence":0.6,"path":"src/safe_storage.rs","line":0,"snippet":"['Encrypt plaintext back', 'BlockEncryptMut', 'Encryptor']","message":"encrypts data [MEDIUM]","category":"other","hardFail":false},{"id":"F-0190c4223472","source":"malcontent","ruleId":"r.37f8ac39acb1","severity":"info","confidence":0.6,"path":"src/safe_storage.rs","line":0,"snippet":"['OpenSSL']","message":"Uses OpenSSL [MEDIUM]","category":"other","hardFail":false},{"id":"F-55802f7460b0","source":"malcontent","ruleId":"r.1e699382d2a5","severity":"info","confidence":0.6,"path":"src/safe_storage.rs","line":0,"snippet":"['base64_content::\"djEwykc2I53A+doQo9OF96du2A==\"']","message":"Contains embedded base64 content [MEDIUM]","category":"other","hardFail":false},{"id":"F-24c8c6dc6d3e","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"src/supergrok/acp.rs","line":0,"snippet":"['agent']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-aece7eded4c6","source":"malcontent","ruleId":"r.5dc13594e86f","severity":"low","confidence":0.6,"path":"src/supergrok/fetch.rs","line":0,"snippet":"['fallback_payload', 'fresh_payload', 'write_payload', 'payload_path', 'payload_age']","message":"payload path [HIGH]","category":"other","hardFail":false},{"id":"F-a380368f99ae","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/supergrok/scope.rs","line":220,"snippet":"(name == \"GROK_OIDC_ISSUER\").then(|| OsString::from(\"https://idp-a.test\"))","message":"URL literal: https://idp-a.test","category":"network","hardFail":false},{"id":"F-9b5f212a5f9d","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/supergrok/scope.rs","line":224,"snippet":"(name == \"GROK_OIDC_ISSUER\").then(|| OsString::from(\"https://idp-b.test\"))","message":"URL literal: https://idp-b.test","category":"network","hardFail":false},{"id":"F-c554b9356d38","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"src/theme.rs","line":5,"snippet":"//!   2. Omarchy theme at `~/.config/omarchy/current/theme/colors.toml`","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-b661d5142340","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"src/theme.rs","line":157,"snippet":"Some(PathBuf::from(home).join(\".config/omarchy/current/theme/colors.toml\"))","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-de573fd69c98","source":"malcontent","ruleId":"r.61ca01356bc1","severity":"info","confidence":0.6,"path":"src/tui/app.rs","line":0,"snippet":"['Keychain']","message":"accesses a keychain [MEDIUM]","category":"other","hardFail":false},{"id":"F-b0d55bfb3e6d","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"src/tui/app.rs","line":0,"snippet":"['agent_auth_path', 'default_agent']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-5dd1b6100cc8","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"src/tui/app.rs","line":238,"snippet":"/// (`$HOME/.config/omarchy/current/theme/colors.toml`) — `new` resolves","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-2058e5417774","source":"malcontent","ruleId":"r.bd0dc86cbeb5","severity":"info","confidence":0.6,"path":"src/tui/settings.rs","line":0,"snippet":"['chmod']","message":"modifies file permissions [MEDIUM]","category":"other","hardFail":false},{"id":"F-c6e43d472722","source":"malcontent","ruleId":"r.f096078dc3a9","severity":"info","confidence":0.6,"path":"src/widget/cli.rs","line":0,"snippet":"['/tmp/acct-a/credentials.json']","message":"path reference within /tmp [MEDIUM]","category":"other","hardFail":false},{"id":"F-a2e0533bb49e","source":"malcontent","ruleId":"r.28ce290c9d3f","severity":"info","confidence":0.6,"path":"src/widget/run.rs","line":0,"snippet":"['sqlite3']","message":"accesses SQLite databases [MEDIUM]","category":"other","hardFail":false},{"id":"F-4777e5acf201","source":"malcontent","ruleId":"r.61ca01356bc1","severity":"info","confidence":0.6,"path":"src/widget/run.rs","line":0,"snippet":"['Keychain', 'keychain']","message":"accesses a keychain [MEDIUM]","category":"other","hardFail":false},{"id":"F-6d61eee7af66","source":"malcontent","ruleId":"r.f096078dc3a9","severity":"info","confidence":0.6,"path":"src/widget/run.rs","line":0,"snippet":"['/tmp/cache/anthropic/work', '/tmp/creds.json']","message":"path reference within /tmp [MEDIUM]","category":"other","hardFail":false},{"id":"F-bbe4fcf2b4d5","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"src/widget/run.rs","line":0,"snippet":"['agent_auth_path', 'default_agent']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-c915476926f4","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/zai/fetch.rs","line":13,"snippet":"pub const QUOTA_URL: &str = \"https://api.z.ai/api/monitor/usage/quota/limit\";","message":"URL literal: https://api.z.ai","category":"network","hardFail":false},{"id":"F-25de4fe53deb","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"src/zai/types.rs","line":2,"snippet":"//! `https://api.z.ai/api/monitor/usage/quota/limit`.","message":"URL literal: https://api.z.ai","category":"network","hardFail":false},{"id":"F-f20d6cdfe8af","source":"malcontent","ruleId":"r.28ce290c9d3f","severity":"info","confidence":0.6,"path":"tests/live.rs","line":0,"snippet":"['sqlite3']","message":"accesses SQLite databases [MEDIUM]","category":"other","hardFail":false},{"id":"F-8530968d5932","source":"malcontent","ruleId":"r.61ca01356bc1","severity":"info","confidence":0.6,"path":"tests/live.rs","line":0,"snippet":"['Keychain']","message":"accesses a keychain [MEDIUM]","category":"other","hardFail":false},{"id":"F-6c71d3288285","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"tests/live.rs","line":0,"snippet":"['agent_auth_path', 'default_agent']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false}],"ai":{"pass1":{"status":"ok","output":{"summary":"QML only runs fixed-argv external ai-usagebar CLI (usage, settings show/apply) and launches a TUI. No obfuscation or injection found. The Rust CLI wasn't reviewed in depth; it reads provider credentials by design.","whatItDoes":{"oneLiner":"Bar widget that periodically runs the external ai-usagebar CLI for JSON usage and shows it in a panel, with settings that pipe API keys to the CLI."},"additionalFindings":[{"severity":"low","path":"omarchy/SettingsView.qml","line":161,"message":"Settings apply passes API keys to the external ai-usagebar CLI, which is not reviewed.","category":"secret","snippet":"command: [\"ai-usagebar\", \"settings\", \"apply\"]"}],"escalate":false,"escalateReason":"","injectionObserved":false,"injectionNotes":"","canaryObserved":false},"turns":4,"costUsd":0.1013772},"pass2":[{"findingId":"F-9df0e6be422e","verdict":"confirmed","reason":"Snippet runs external 'ai-usagebar' binary via Process; it is not part of the repository snippets shown."},{"findingId":"F-24d84c301ed2","verdict":"unsure","reason":"Only the trigger block is shown; no cache or artifact steps visible to judge cache poisoning."},{"findingId":"F-5e6df67d720c","verdict":"confirmed","reason":"`command -v ${cli}` interpolated into bash -lc; injection if cli is untrusted. Origin of cli not visible."},{"findingId":"F-cc336e1bead4","verdict":"unsure","reason":"Process invokes 'ai-usagebar settings apply' with stdin enabled, but snippet does not show API keys being written."},{"findingId":"F-c1b535e8d273","verdict":"likely-fp","reason":"Value is a fixed test-fixture assertion in a unit test (assert_eq), not a real secret."}],"guard":{"canaryOk":true,"positiveControlOk":null,"disallowedToolUse":false,"schemaValid":true,"failures":[]}}}}}],"listing":{"id":"akitaonrails.ai-usagebar","name":"AI Usage","ini":"AU","accent":"amber","author":"AkitaOnRails","desc":"Multi-provider AI plan usage and balances in a native Omarchy Quattro panel. Needs the ai-usagebar binary as well as this plugin: omarchy pkg aur add ai-usagebar-bin","cat":"Widgets","kind":"Bar widget","tags":["ai","bar","quickshell"],"repo":"https://github.com/akitaonrails/ai-usagebar","verif":"unverified","listed":"2026-08-14T21:42:51Z","updated":"2026-10-16T02:58:17Z","gallery":["https://raw.githubusercontent.com/akitaonrails/ai-usagebar/f97675a8b50da296c8eb26b9cef2d0a63c4e2702/screenshots/omarchy-quattro-panel.png","https://raw.githubusercontent.com/akitaonrails/ai-usagebar/f97675a8b50da296c8eb26b9cef2d0a63c4e2702/screenshots/omarchy-quattro-settings.png","https://raw.githubusercontent.com/akitaonrails/ai-usagebar/f97675a8b50da296c8eb26b9cef2d0a63c4e2702/screenshots/windows-tray-dashboard.png","https://raw.githubusercontent.com/akitaonrails/ai-usagebar/f97675a8b50da296c8eb26b9cef2d0a63c4e2702/screenshots/windows-tray-icon.png","https://raw.githubusercontent.com/akitaonrails/ai-usagebar/f97675a8b50da296c8eb26b9cef2d0a63c4e2702/screenshots/windows-tray-native-light.png","https://raw.githubusercontent.com/akitaonrails/ai-usagebar/f97675a8b50da296c8eb26b9cef2d0a63c4e2702/screenshots/windows-tray-native-dark.png","https://raw.githubusercontent.com/akitaonrails/ai-usagebar/f97675a8b50da296c8eb26b9cef2d0a63c4e2702/screenshots/windows-tray-native-settings-light.png","https://raw.githubusercontent.com/akitaonrails/ai-usagebar/f97675a8b50da296c8eb26b9cef2d0a63c4e2702/screenshots/windows-tray-native-settings-dark.png"],"gh":{"stars":696,"vel30":156,"lastCommit":"2026-10-18T18:08:08Z","c90":1355,"contrib":7,"bus":2,"rel180":20,"lastRelease":"v1.41.0","issues":0,"respH":19.6,"archived":false,"branch":"main"},"mkt":{"views":19897,"copies":3732,"hearts":171},"rank":2,"score":84.78,"fac":[18.8,13.5,10.8,11.0,8.0,8.0,3.7,9.5,1.5],"verdict":{"combined":"caution","basis":"trusted","providers":{"opc":"caution"},"commit":"b1766cb92ebd9c98776bf1777ccfb9dc30c7b789","tree":"619530c40addbf8f633fb91422f5017bf309677d","criteria":{"checked":["no-network","no-exec","no-persistence","no-privilege","no-obfuscation","no-secrets"],"failed":["no-exec"]},"risk":16},"report":true,"license":"MIT","version":"1.38.1"},"activity":{"weeks":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,100]}}