{
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "git+https://github.com/akitaonrails/ai-usagebar",
"digest": {
"gitCommit": "b1766cb92ebd9c98776bf1777ccfb9dc30c7b789",
"gitTree": "619530c40addbf8f633fb91422f5017bf309677d"
}
}
],
"predicateType": "https://prometheusroot.github.io/omarchy-plugin-check/attestation/security-review/v1",
"predicate": {
"provider": {
"id": "opc",
"scannerVersion": "0.1.0",
"method": [
"static",
"ai"
]
},
"plugin": {
"id": "akitaonrails.ai-usagebar",
"catalogGeneratedAt": "2026-09-30T14:53:56.598Z",
"target": "marketplace-listing"
},
"timeReviewed": "2026-10-02T10:55:12Z",
"verdict": "caution",
"summary": "caution: external-code (14 finding(s) above info)",
"criteria": {
"checked": [
"no-network",
"no-exec",
"no-persistence",
"no-privilege",
"no-obfuscation",
"no-secrets"
],
"failed": [
"no-exec"
],
"notChecked": [
"safe-to-run",
"reviewed-by-human"
]
},
"scope": {
"kind": "full",
"path": ""
},
"findings": [
{
"category": "external-code",
"severity": "medium",
"confidence": 0.8,
"message": "Runs 'ai-usagebar', which is not in the repository or the Omarchy base install: its code was not reviewed (installed separately, e.g. from the AUR).",
"locations": [
{
"path": "omarchy/Panel.qml",
"startLine": 207
}
]
},
{
"category": "supply-chain",
"severity": "low",
"confidence": 0.5,
"message": "runtime artifacts potentially vulnerable to a cache poisoning attack (https://docs.zizmor.sh/audits/#cache-poisoning)",
"locations": [
{
"path": ".github/workflows/release.yml",
"startLine": 3
}
]
},
{
"category": "external-code",
"severity": "low",
"confidence": 0.9,
"message": "Declares 23 runtime dependencies fetched from a package registry at install/build time (not reviewed): aes, base64, cbc, chrono, clap, ctrlc, directories, fs2 …",
"locations": [
{
"path": "Cargo.toml"
}
]
},
{
"category": "exec",
"severity": "low",
"confidence": 0.7,
"message": "Shell command string built by concatenation inside `sh -c` — command injection if any part is untrusted (network data, file names, user input).",
"locations": [
{
"path": "gnome-extension/prefs.js",
"startLine": 112
}
]
},
{
"category": "other",
"severity": "low",
"confidence": 0.6,
"message": "Looks up a password from the Keychain [HIGH]",
"locations": [
{
"path": "macos/ai-usagebar-menubar.swift"
}
]
},
{
"category": "other",
"severity": "low",
"confidence": 0.6,
"message": "sets up an embedded LaunchAgent and launches it [HIGH]",
"locations": [
{
"path": "macos/install-agent.sh"
}
]
},
{
"category": "secret",
"severity": "low",
"confidence": 0.6,
"message": "Settings apply passes API keys to the external ai-usagebar CLI, which is not reviewed.",
"locations": [
{
"path": "omarchy/SettingsView.qml",
"startLine": 161
}
]
},
{
"category": "other",
"severity": "low",
"confidence": 0.6,
"message": "Looks up a password from the Keychain [HIGH]",
"locations": [
{
"path": "src/anthropic/keychain.rs"
}
]
},
{
"category": "other",
"severity": "low",
"confidence": 0.6,
"message": "payload path [HIGH]",
"locations": [
{
"path": "src/cache.rs"
}
]
},
{
"category": "other",
"severity": "low",
"confidence": 0.6,
"message": "payload path [HIGH]",
"locations": [
{
"path": "src/kimi/fetch.rs"
}
]
},
{
"category": "secret",
"severity": "low",
"confidence": 0.7,
"message": "Possible hard-coded secret (Detected a Generic API Key, potentially exposing access to various services and sensitive operations.); value redacted, liveness not verified.",
"locations": [
{
"path": "src/kiro/db.rs",
"startLine": 400
}
]
},
{
"category": "other",
"severity": "low",
"confidence": 0.6,
"message": "payload path [HIGH]",
"locations": [
{
"path": "src/minimax/fetch.rs"
}
]
},
{
"category": "other",
"severity": "low",
"confidence": 0.6,
"message": "Looks up a password from the Keychain [HIGH]",
"locations": [
{
"path": "src/safe_storage.rs"
}
]
},
{
"category": "other",
"severity": "low",
"confidence": 0.6,
"message": "payload path [HIGH]",
"locations": [
{
"path": "src/supergrok/fetch.rs"
}
]
}
],
"quality": {
"score": 99
},
"policy": {
"uri": "https://prometheusroot.github.io/omarchy-plugin-check/policy/v1"
},
"report": {
"schemaVersion": 1,
"plugin": {
"id": "akitaonrails.ai-usagebar",
"name": "AI Usage",
"repo": "https://github.com/akitaonrails/ai-usagebar",
"listingState": "listed",
"marketplace": {
"verificationCommit": null,
"listingValidatedCommit": "b1766cb92ebd9c98776bf1777ccfb9dc30c7b789",
"upstreamObservedCommit": "39f429ef66ff5fc1fb6561c70a9d739b908d8dbf",
"baselineOutcome": "passed",
"verificationStatus": "unverified",
"caps": [],
"stars": 597,
"catalogGeneratedAt": "2026-09-30T14:53:56.598Z",
"manifestPath": "manifest.json",
"repositoryLayout": "root-plugin",
"author": "AkitaOnRails",
"description": "Multi-provider AI plan usage and balances in a native Omarchy Quattro panel. Needs the ai-usagebar binary as well as this plugin: omarchy pkg aur add ai-usagebar-bin",
"category": "Widgets",
"kind": "Bar widget",
"tags": [
"ai",
"bar",
"quickshell"
],
"license": "MIT",
"installCommand": "omarchy plugin add https://github.com/akitaonrails/ai-usagebar.git --enable"
}
},
"review": {
"commit": "b1766cb92ebd9c98776bf1777ccfb9dc30c7b789",
"scanTarget": "marketplace-listing",
"pluginPath": "",
"reviewedAt": "2026-10-02T10:55:12Z",
"aiModel": "sonnet+fable",
"upstreamHeadAtScan": "ad28ba6118b6ac391ea54b76a0498c76d814de22",
"previousCommit": null,
"tools": [
{
"name": "inventory",
"version": null,
"status": "ok"
},
{
"name": "textscan",
"version": null,
"status": "ok"
},
{
"name": "extcode",
"version": null,
"status": "ok"
},
{
"name": "heckler",
"version": "1.0.0",
"status": "ok"
},
{
"name": "ctxsentry",
"version": "0.5.0",
"status": "ok"
},
{
"name": "opengrep",
"version": "1.30.0",
"status": "ok"
},
{
"name": "yara",
"version": "4.5.4",
"status": "ok"
},
{
"name": "malcontent",
"version": "1.26.1",
"status": "ok"
},
{
"name": "shellcheck",
"version": "0.11.0",
"status": "ok"
},
{
"name": "bandit",
"version": null,
"status": "skipped"
},
{
"name": "eslint",
"version": "10.11.0",
"status": "ok"
},
{
"name": "qmllint",
"version": "6.4.2",
"status": "ok"
},
{
"name": "gitleaks",
"version": "8.30.1",
"status": "ok"
},
{
"name": "guarddog",
"version": "3.2.0",
"status": "ok"
},
{
"name": "osv",
"version": "2.6.0",
"status": "failed"
},
{
"name": "zizmor",
"version": "1.30.1",
"status": "ok"
},
{
"name": "clamav",
"version": null,
"status": "skipped"
},
{
"name": "perf",
"version": null,
"status": "ok"
},
{
"name": "quality",
"version": null,
"status": "ok"
}
],
"rulesVersion": "r-05e7b1572de1",
"scannerVersion": "0.1.0"
},
"verdict": {
"outcome": "caution",
"score": 16,
"hardFails": [],
"aiEscalation": null,
"summary": "caution: score 16; 1 medium, 12 low; uses processExec, externalCode",
"reasons": [
"capabilities: processExec",
"relies on external code not in the reviewed commit, so safe-to-run is not checked: ai-usagebar (binary, aur), ai-usagebar (system-package, aur), ai-usagebar-bin (system-package, aur), aes (package, cargo), base64 (package, cargo), cbc (package, cargo) +20 more"
],
"criteria": {
"checked": [
"no-network",
"no-exec",
"no-persistence",
"no-privilege",
"no-obfuscation",
"no-secrets"
],
"failed": [
"no-exec"
],
"notChecked": [
"safe-to-run",
"reviewed-by-human"
]
}
},
"whatItDoes": {
"oneLiner": "Bar widget that periodically runs the external ai-usagebar CLI for JSON usage and shows it in a panel, with settings that pipe API keys to the CLI.",
"kinds": [
"bar-widget"
],
"entryPoints": [
{
"key": "barWidget",
"path": "omarchy/BarWidget.qml"
}
],
"manifestValid": true,
"manifestError": null
},
"capabilities": {
"processExec": {
"level": "med",
"evidence": [
"F-a221d57df5e5",
"F-b822db682cf8",
"F-a699d00a7837",
"F-c0163704c740",
"F-6e3a7941ca5e",
"F-cb63ac414146",
"F-a42799075481",
"F-5e6df67d720c"
]
},
"network": {
"level": "none",
"evidence": []
},
"fileWrite": {
"level": "none",
"evidence": []
},
"persistence": {
"level": "none",
"evidence": []
},
"privilege": {
"level": "none",
"evidence": []
},
"packageInstall": {
"level": "none",
"evidence": []
},
"bundledBinary": {
"level": "none",
"evidence": []
},
"clipboard": {
"level": "none",
"evidence": []
},
"screenCapture": {
"level": "none",
"evidence": []
},
"hyprlandIpc": {
"level": "none",
"evidence": []
},
"externalCode": {
"level": "high",
"evidence": [
"F-9df0e6be422e",
"F-7fd928372ea7"
],
"externals": [
{
"name": "ai-usagebar",
"kind": "binary",
"source": "aur",
"evidence": [
"F-9df0e6be422e",
"F-cf4b264b48a8",
"F-bc1d5e0ce1a6",
"F-edcce107df19"
]
},
{
"name": "ai-usagebar",
"kind": "system-package",
"source": "aur",
"evidence": [
"F-24b05347190e"
]
},
{
"name": "ai-usagebar-bin",
"kind": "system-package",
"source": "aur",
"evidence": [
"F-cf4b264b48a8",
"F-bc1d5e0ce1a6",
"F-edcce107df19"
]
},
{
"name": "aes",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "base64",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "cbc",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "chrono",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "clap",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "ctrlc",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "directories",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "fs2",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "pbkdf2",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "ratatui",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "ratatui-bubbletea-components",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "ratatui-bubbletea-theme",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "reqwest",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "rusqlite",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "serde",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "serde_json",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "sha1",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "sha2",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "tempfile",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "thiserror",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "tokio",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "toml",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
},
{
"name": "toml_edit",
"kind": "package",
"source": "cargo",
"evidence": [
"F-7fd928372ea7"
]
}
]
}
},
"systemAreas": {
"touched": [
"omarchy-shell"
],
"evidence": [
{
"area": "omarchy-shell",
"findings": [
"F-89aef16435b0",
"F-0b98935aa7bd"
]
}
]
},
"network": {
"hosts": [
{
"host": "127.0.0.1",
"schemes": [
"http"
],
"evidence": [
"F-8a091eab6eac",
"F-937370506d28",
"F-a7e3b21d7a0a"
]
},
{
"host": "api.anthropic.com",
"schemes": [
"https"
],
"evidence": [
"F-86f7e0a23232",
"F-087638c52926",
"F-bc2cc5406151",
"F-eaabed1238d0"
]
},
{
"host": "api.deepseek.com",
"schemes": [
"https"
],
"evidence": [
"F-3c53cbef219c"
]
},
{
"host": "api.kilo.ai",
"schemes": [
"https"
],
"evidence": [
"F-09911851043b"
]
},
{
"host": "api.kimi.com",
"schemes": [
"https"
],
"evidence": [
"F-effa5afcaaf4"
]
},
{
"host": "api.minimax.io",
"schemes": [
"https"
],
"evidence": [
"F-8021c84c7aa7"
]
},
{
"host": "api.minimaxi.com",
"schemes": [
"https"
],
"evidence": [
"F-8d3aeccfabfc"
]
},
{
"host": "api.moonshot.ai",
"schemes": [
"https"
],
"evidence": [
"F-e218c2244502"
]
},
{
"host": "api.moonshot.cn",
"schemes": [
"https"
],
"evidence": [
"F-ca6a03f7195b"
]
},
{
"host": "api.novita.ai",
"schemes": [
"https"
],
"evidence": [
"F-a63a94cd6564"
]
},
{
"host": "api.openai.com",
"schemes": [
"https"
],
"evidence": [
"F-be6f222a6b48",
"F-7a37082e4fd2"
]
},
{
"host": "api.z.ai",
"schemes": [
"https"
],
"evidence": [
"F-c915476926f4",
"F-25de4fe53deb"
]
},
{
"host": "auth.openai.com",
"schemes": [
"https"
],
"evidence": [
"F-4621f01e66d1"
]
},
{
"host": "chatgpt.com",
"schemes": [
"https"
],
"evidence": [
"F-d832236ecba3",
"F-b952226f2b9f"
]
},
{
"host": "codewhisperer.us-east-1.amazonaws.com",
"schemes": [
"https"
],
"evidence": [
"F-4a87ce20b8a1"
]
},
{
"host": "cursor.com",
"schemes": [
"https"
],
"evidence": [
"F-7eb827f40213"
]
},
{
"host": "docs.aws.amazon.com",
"schemes": [
"https"
],
"evidence": [
"F-4547a43ec67d"
]
},
{
"host": "docs.x.ai",
"schemes": [
"https"
],
"evidence": [
"F-2a44186da8d4"
]
},
{
"host": "github.com",
"schemes": [
"https"
],
"evidence": [
"F-454d72bc4d6b",
"F-72d594b4239c",
"F-615127b9001d",
"F-c24230d60b6b",
"F-cefe99a2ef6a",
"F-9ffd4dbd7a0e"
]
},
{
"host": "idp-a.test",
"schemes": [
"https"
],
"evidence": [
"F-a380368f99ae"
]
},
{
"host": "idp-b.test",
"schemes": [
"https"
],
"evidence": [
"F-9b5f212a5f9d"
]
},
{
"host": "localhost",
"schemes": [
"http"
],
"evidence": [
"F-d6ca150091a1",
"F-073bf0768593"
]
},
{
"host": "management-api.x.ai",
"schemes": [
"https"
],
"evidence": [
"F-06d2d33a0c66"
]
},
{
"host": "novita.ai",
"schemes": [
"https"
],
"evidence": [
"F-7bb1d950fcc8"
]
},
{
"host": "oidc.us-east-1.amazonaws.com",
"schemes": [
"https"
],
"evidence": [
"F-296258cdfe95"
]
},
{
"host": "oidc.us-gov-west-1.amazonaws.com",
"schemes": [
"https"
],
"evidence": [
"F-b46ac015dac3"
]
},
{
"host": "openrouter.ai",
"schemes": [
"https"
],
"evidence": [
"F-e3518096a36e"
]
},
{
"host": "platform.claude.com",
"schemes": [
"https"
],
"evidence": [
"F-fae2841d18bb",
"F-fd781f6473a6",
"F-81cd713f7de8"
]
},
{
"host": "www.apple.com",
"schemes": [
"http"
],
"evidence": [
"F-926a9faf2be0"
]
}
]
},
"dependencies": {
"packages": [
{
"name": "tokio",
"version": "1",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "reqwest",
"version": "0.12",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "serde",
"version": "1",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "serde_json",
"version": "1",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "toml",
"version": "0.8",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "toml_edit",
"version": "0.25",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "clap",
"version": "4",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "chrono",
"version": "0.4",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "fs2",
"version": "0.4",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "tempfile",
"version": "3",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "directories",
"version": "6",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "thiserror",
"version": "2",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "ctrlc",
"version": "3",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "base64",
"version": "0.23",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "aes",
"version": "0.8",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "cbc",
"version": "0.1",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "pbkdf2",
"version": "0.13",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "sha1",
"version": "0.11",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "sha2",
"version": "0.10",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "ratatui",
"version": "0.30.1",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "ratatui-bubbletea-components",
"version": "0.2",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "ratatui-bubbletea-theme",
"version": "0.2",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "rusqlite",
"version": "0.39",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "mockito",
"version": "1",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "insta",
"version": "1",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "pretty_assertions",
"version": "1",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
},
{
"name": "tempfile",
"version": "3",
"ecosystem": "cargo",
"direct": true,
"pinned": true,
"manifestPath": "Cargo.toml"
}
],
"systemPackages": [
{
"name": "ai-usagebar",
"source": "aur",
"evidence": [
"F-ac6d75c2386a",
"F-24b05347190e"
]
},
{
"name": "ai-usagebar-bin",
"source": "aur",
"evidence": [
"F-511e84dc46f8",
"F-cf4b264b48a8",
"F-bc1d5e0ce1a6",
"F-edcce107df19"
]
}
],
"vulnerabilities": []
},
"secrets": {
"count": 1,
"items": [
{
"findingId": "F-c1b535e8d273",
"kind": "generic-api-key",
"live": null
}
]
},
"supplyChain": {
"scorecard": null,
"pinnedDeps": true,
"signedCommitRatio": 0.4,
"busFactor": 1,
"repoAgeDays": 131,
"unpinnedRemoteFetches": []
},
"injection": {
"hiddenUnicode": {
"count": 0,
"evidence": []
},
"promptInjection": {
"count": 0,
"evidence": []
},
"obfuscation": {
"count": 0,
"evidence": []
}
},
"codeQuality": {
"loc": {
"total": 49709,
"byLanguage": [
{
"language": "Rust",
"files": 113,
"lines": 42796
},
{
"language": "Swift",
"files": 2,
"lines": 3209
},
{
"language": "JavaScript",
"files": 6,
"lines": 1657
},
{
"language": "QML",
"files": 3,
"lines": 1082
},
{
"language": "YAML",
"files": 3,
"lines": 411
},
{
"language": "TOML",
"files": 2,
"lines": 335
},
{
"language": "Shell",
"files": 5,
"lines": 160
},
{
"language": "Makefile",
"files": 1,
"lines": 33
},
{
"language": "CSS",
"files": 1,
"lines": 26
}
]
},
"lint": [
{
"tool": "shellcheck",
"errors": 1,
"warnings": 17
},
{
"tool": "eslint",
"errors": 3,
"warnings": 40
},
{
"tool": "qmllint",
"errors": 0,
"warnings": 1160
}
],
"tests": {
"present": true,
"files": 5
},
"docs": {
"readme": true,
"changelog": true
},
"license": {
"spdx": "MIT",
"file": true
},
"hotspots": [
{
"path": "omarchy/Panel.qml",
"reason": "r.5b0c49abe65e"
},
{
"path": ".github/workflows/release.yml",
"reason": "r.738c1f331045"
},
{
"path": "Cargo.toml",
"reason": "r.66259759e39a"
},
{
"path": "gnome-extension/prefs.js",
"reason": "r.01e0e842c851"
},
{
"path": "macos/ai-usagebar-menubar.swift",
"reason": "r.61ca01356bc1"
},
{
"path": "macos/install-agent.sh",
"reason": "r.1bf2a0b4b5c8"
},
{
"path": "src/anthropic/keychain.rs",
"reason": "r.61ca01356bc1"
},
{
"path": "src/cache.rs",
"reason": "r.5dc13594e86f"
}
]
},
"performance": {
"timers": [
{
"path": "omarchy/Panel.qml",
"line": 189,
"intervalMs": null,
"repeat": true,
"spawnsProcess": false
},
{
"path": "omarchy/Panel.qml",
"line": 197,
"intervalMs": 30000,
"repeat": true,
"spawnsProcess": false
}
],
"estSpawnsPerMin": 0.0,
"keepLoaded": true,
"largeAssets": [
{
"path": "screenshot.png",
"bytes": 3848848
}
],
"polling": [
"F-bc8ca7f997c9"
]
},
"maintenance": {
"lastCommitAt": "2026-08-14T21:40:49Z",
"commits90d": 265,
"contributors": 23,
"openIssues": null,
"archived": null,
"latestRelease": "v1.4.0"
},
"diffSinceLastReview": null,
"findings": [
{
"id": "F-5e21f4a7a640",
"source": "zizmor",
"ruleId": "r.ab9fa6693ebd",
"severity": "info",
"confidence": 0.9,
"path": ".github/dependabot.yml",
"line": 3,
"snippet": "package-ecosystem: github-actions",
"message": "insufficient cooldown in Dependabot updates (https://docs.zizmor.sh/audits/#dependabot-cooldown)",
"category": "supply-chain",
"hardFail": false
},
{
"id": "F-53a663d3e328",
"source": "zizmor",
"ruleId": "r.ab9fa6693ebd",
"severity": "info",
"confidence": 0.9,
"path": ".github/dependabot.yml",
"line": 8,
"snippet": "package-ecosystem: cargo",
"message": "insufficient cooldown in Dependabot updates (https://docs.zizmor.sh/audits/#dependabot-cooldown)",
"category": "supply-chain",
"hardFail": false
},
{
"id": "F-85a7c9158465",
"source": "zizmor",
"ruleId": "r.f629672d34ab",
"severity": "info",
"confidence": 0.5,
"path": ".github/workflows/ci.yml",
"line": 26,
"snippet": "uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1",
"message": "credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)",
"category": "supply-chain",
"hardFail": false
},
{
"id": "F-e70b02ad3a82",
"source": "zizmor",
"ruleId": "r.f629672d34ab",
"severity": "info",
"confidence": 0.5,
"path": ".github/workflows/ci.yml",
"line": 53,
"snippet": "uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1",
"message": "credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)",
"category": "supply-chain",
"hardFail": false
},
{
"id": "F-cf4e6bb9d749",
"source": "zizmor",
"ruleId": "r.f629672d34ab",
"severity": "info",
"confidence": 0.5,
"path": ".github/workflows/ci.yml",
"line": 70,
"snippet": "uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1",
"message": "credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)",
"category": "supply-chain",
"hardFail": false
},
{
"id": "F-17b7a81ea7cb",
"source": "zizmor",
"ruleId": "r.f629672d34ab",
"severity": "info",
"confidence": 0.5,
"path": ".github/workflows/ci.yml",
"line": 92,
"snippet": "uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1",
"message": "credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)",
"category": "supply-chain",
"hardFail": false
},
{
"id": "F-24d84c301ed2",
"source": "zizmor",
"ruleId": "r.02ed6a656740",
"severity": "low",
"confidence": 0.5,
"path": ".github/workflows/release.yml",
"line": 3,
"snippet": "on: push: tags: [\"v*\"] workflow_dispatch: inputs: ref: description: \"Existing release tag to build (e.g. v0.13.1)\" required: true default: \"\"",
"message": "runtime artifacts potentially vulnerable to a cache poisoning attack (https://docs.zizmor.sh/audits/#cache-poisoning)",
"category": "supply-chain",
"hardFail": false
},
{
"id": "F-2698fb28636d",
"source": "zizmor",
"ruleId": "r.f629672d34ab",
"severity": "info",
"confidence": 0.5,
"path": ".github/workflows/release.yml",
"line": 26,
"snippet": "uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.ref || github.ref }} # Tags are needed to prove a workflow_dispatch ref is a real tag. fetch-depth: 0",
"message": "credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)",
"category": "supply-chain",
"hardFail": false
},
{
"id": "F-c0c6096426f9",
"source": "zizmor",
"ruleId": "r.f629672d34ab",
"severity": "info",
"confidence": 0.5,
"path": ".github/workflows/release.yml",
"line": 100,
"snippet": "uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.ref || github.ref }}",
"message": "credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)",
"category": "supply-chain",
"hardFail": false
},
{
"id": "F-43e76c17a128",
"source": "opengrep",
"ruleId": "r.35725ec3d681",
"severity": "info",
"confidence": 0.9,
"path": ".github/workflows/release.yml",
"line": 117,
"snippet": "run: sudo apt-get update && sudo apt-get install -y nasm",
"message": "Runs commands as root via sudo/doas/run0.",
"category": "privilege",
"hardFail": false
},
{
"id": "F-fea1de6aa5f0",
"source": "zizmor",
"ruleId": "r.f629672d34ab",
"severity": "info",
"confidence": 0.5,
"path": ".github/workflows/release.yml",
"line": 162,
"snippet": "name: Checkout source (for CHANGELOG + previous tag) uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.ref || github.ref }} fetch-depth: 0",
"message": "credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)",
"category": "supply-chain",
"hardFail": false
},
{
"id": "F-a452f591f458",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": ".github/workflows/release.yml",
"line": 206,
"snippet": "echo \"yay -S ai-usagebar-bin # prebuilt binary from this release\"",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-7f35461e2782",
"source": "opengrep",
"ruleId": "r.77dfe677dff7",
"severity": "info",
"confidence": 0.9,
"path": ".github/workflows/release.yml",
"line": 206,
"snippet": "echo \"yay -S ai-usagebar-bin # prebuilt binary from this release\"",
"message": "Installs system packages (pacman / AUR helper / omarchy pkg).",
"category": "package",
"hardFail": false
},
{
"id": "F-511e84dc46f8",
"source": "textscan",
"ruleId": "r.f93d25679c59",
"severity": "info",
"confidence": 1.0,
"path": ".github/workflows/release.yml",
"line": 206,
"snippet": "echo \"yay -S ai-usagebar-bin # prebuilt binary from this release\"",
"message": "System package referenced for install: ai-usagebar-bin (aur)",
"category": "package",
"hardFail": false
},
{
"id": "F-d39978114305",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": ".github/workflows/release.yml",
"line": 207,
"snippet": "echo \"yay -S ai-usagebar # compiles from source\"",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-7f45cfc4fe13",
"source": "opengrep",
"ruleId": "r.77dfe677dff7",
"severity": "info",
"confidence": 0.9,
"path": ".github/workflows/release.yml",
"line": 207,
"snippet": "echo \"yay -S ai-usagebar # compiles from source\"",
"message": "Installs system packages (pacman / AUR helper / omarchy pkg).",
"category": "package",
"hardFail": false
},
{
"id": "F-ac6d75c2386a",
"source": "textscan",
"ruleId": "r.f93d25679c59",
"severity": "info",
"confidence": 1.0,
"path": ".github/workflows/release.yml",
"line": 207,
"snippet": "echo \"yay -S ai-usagebar # compiles from source\"",
"message": "System package referenced for install: ai-usagebar (aur)",
"category": "package",
"hardFail": false
},
{
"id": "F-b76cb5870c5f",
"source": "opengrep",
"ruleId": "r.ffe891943e29",
"severity": "info",
"confidence": 0.9,
"path": ".github/workflows/release.yml",
"line": 213,
"snippet": "echo \"curl -fsSL https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}/ai-usagebar-linux-x86_64.tar.gz | tar xz -C ~/.local/bin ai-usagebar ai-usagebar-tui\"",
"message": "Network client invoked from a script or Process command (curl/wget/nc/...).",
"category": "network",
"hardFail": false
},
{
"id": "F-00e51592d80d",
"source": "zizmor",
"ruleId": "r.f629672d34ab",
"severity": "info",
"confidence": 0.5,
"path": ".github/workflows/release.yml",
"line": 252,
"snippet": "uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.ref || github.ref }}",
"message": "credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)",
"category": "supply-chain",
"hardFail": false
},
{
"id": "F-fc6b388837a6",
"source": "zizmor",
"ruleId": "r.0691a68253fe",
"severity": "info",
"confidence": 0.9,
"path": ".github/workflows/release.yml",
"line": 257,
"snippet": "name: Publish to crates.io env: CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} run: | if [ -z \"$CARGO_REGISTRY_TOKEN\" ]; then echo \"::warning::Skipping crates.io publish — no CARGO_REGISTRY_TOKEN secret set\" exit 0 fi",
"message": "prefer trusted publishing for authentication (https://docs.zizmor.sh/audits/#use-trusted-publishing)",
"category": "supply-chain",
"hardFail": false
},
{
"id": "F-4d6817995919",
"source": "zizmor",
"ruleId": "r.f629672d34ab",
"severity": "info",
"confidence": 0.5,
"path": ".github/workflows/release.yml",
"line": 287,
"snippet": "uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.ref || github.ref }}",
"message": "credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)",
"category": "supply-chain",
"hardFail": false
},
{
"id": "F-09347ae6da6a",
"source": "opengrep",
"ruleId": "r.ffe891943e29",
"severity": "info",
"confidence": 0.9,
"path": ".github/workflows/release.yml",
"line": 304,
"snippet": "SRC_SHA=$(curl -fsSL \"$SRC_URL\" | sha256sum | awk '{print $1}')",
"message": "Network client invoked from a script or Process command (curl/wget/nc/...).",
"category": "network",
"hardFail": false
},
{
"id": "F-c3e3a11eed68",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": ".github/workflows/release.yml",
"line": 314,
"snippet": "# `-bin` variant under that name. Without this, makepkg generates",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-3affa6a5db7e",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": ".github/workflows/release.yml",
"line": 333,
"snippet": "# regenerates .SRCINFO via makepkg, then commits + pushes via SSH.",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-2f5ea939391f",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": ".gitignore",
"line": 18,
"snippet": "# makepkg build outputs (kept out of the source repo)",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-ee5e182f6732",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "CHANGELOG.md",
"line": 34,
"snippet": "installable with `omarchy plugin add` and renders every configured provider",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-cc76f57793af",
"source": "opengrep",
"ruleId": "r.0288ce1d8585",
"severity": "info",
"confidence": 0.9,
"path": "CHANGELOG.md",
"line": 83,
"snippet": "`cargo install --list`.",
"message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).",
"category": "package",
"hardFail": false
},
{
"id": "F-e86a453d3ce6",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": "CHANGELOG.md",
"line": 1179,
"snippet": "intact. Result: `makepkg --printsrcinfo` ran against the old file,",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-e98f23f9ff97",
"source": "opengrep",
"ruleId": "r.0288ce1d8585",
"severity": "info",
"confidence": 0.9,
"path": "CHANGELOG.md",
"line": 1211,
"snippet": "- **Published to crates.io** — `cargo install ai-usagebar` works on",
"message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).",
"category": "package",
"hardFail": false
},
{
"id": "F-aaba8fd213b9",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": "CHANGELOG.md",
"line": 1218,
"snippet": "`ai-usagebar-bin` AUR package uses, just without yay. Metadata in",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-ea6d2f6bb3df",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": "CHANGELOG.md",
"line": 1310,
"snippet": "same way as x86_64 users: `yay -S ai-usagebar-bin`.",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-c0a376e8bd7d",
"source": "opengrep",
"ruleId": "r.77dfe677dff7",
"severity": "info",
"confidence": 0.9,
"path": "CHANGELOG.md",
"line": 1310,
"snippet": "same way as x86_64 users: `yay -S ai-usagebar-bin`.",
"message": "Installs system packages (pacman / AUR helper / omarchy pkg).",
"category": "package",
"hardFail": false
},
{
"id": "F-cf4b264b48a8",
"source": "textscan",
"ruleId": "r.f93d25679c59",
"severity": "info",
"confidence": 1.0,
"path": "CHANGELOG.md",
"line": 1310,
"snippet": "same way as x86_64 users: `yay -S ai-usagebar-bin`.",
"message": "System package referenced for install: ai-usagebar-bin (aur)",
"category": "package",
"hardFail": false
},
{
"id": "F-6265363a7d4c",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": "CHANGELOG.md",
"line": 1362,
"snippet": "both PKGBUILDs now declare the cross-variant `conflicts` so pacman",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-8f0924e437ca",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": "CLAUDE.md",
"line": 24,
"snippet": "cd packaging/aur && makepkg --printsrcinfo > .SRCINFO",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-ac39620afe5d",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": "CLAUDE.md",
"line": 25,
"snippet": "# PKGBUILD-bin must be named PKGBUILD for makepkg — use a scratch dir:",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-9d4a70ac1f6f",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": "CLAUDE.md",
"line": 27,
"snippet": "(cd \"$t\" && makepkg --printsrcinfo > .SRCINFO-bin) &&",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-3af7687d0338",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "CLAUDE.md",
"line": 37,
"snippet": "omarchy plugin validate . # plugin manifest + entry points",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-b3a7fdb12de3",
"source": "opengrep",
"ruleId": "r.ffe891943e29",
"severity": "info",
"confidence": 0.9,
"path": "CLAUDE.md",
"line": 60,
"snippet": "curl -sLO https://github.com/akitaonrails/ai-usagebar/archive/refs/tags/vX.Y.Z.tar.gz",
"message": "Network client invoked from a script or Process command (curl/wget/nc/...).",
"category": "network",
"hardFail": false
},
{
"id": "F-361fbcc81acc",
"source": "opengrep",
"ruleId": "r.ffe891943e29",
"severity": "info",
"confidence": 0.9,
"path": "CLAUDE.md",
"line": 63,
"snippet": "curl -sL https://github.com/akitaonrails/ai-usagebar/releases/download/vX.Y.Z/ai-usagebar-linux-x86_64.tar.gz.sha256",
"message": "Network client invoked from a script or Process command (curl/wget/nc/...).",
"category": "network",
"hardFail": false
},
{
"id": "F-f85d3abcdbb7",
"source": "opengrep",
"ruleId": "r.ffe891943e29",
"severity": "info",
"confidence": 0.9,
"path": "CLAUDE.md",
"line": 65,
"snippet": "curl -sL https://github.com/akitaonrails/ai-usagebar/releases/download/vX.Y.Z/ai-usagebar-linux-aarch64.tar.gz.sha256",
"message": "Network client invoked from a script or Process command (curl/wget/nc/...).",
"category": "network",
"hardFail": false
},
{
"id": "F-b27ca239fc05",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": "CLAUDE.md",
"line": 105,
"snippet": "during `makepkg`, so any test that reads a user's *customized* files",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-51c0b49cd336",
"source": "opengrep",
"ruleId": "r.ffe891943e29",
"severity": "info",
"confidence": 0.9,
"path": "CLAUDE.md",
"line": 141,
"snippet": "1. Capture the actual response (`curl -sH \"Authorization: …\" …`).",
"message": "Network client invoked from a script or Process command (curl/wget/nc/...).",
"category": "network",
"hardFail": false
},
{
"id": "F-7fd928372ea7",
"source": "extcode",
"ruleId": "r.66259759e39a",
"severity": "low",
"confidence": 0.9,
"path": "Cargo.toml",
"line": 0,
"snippet": "",
"message": "Declares 23 runtime dependencies fetched from a package registry at install/build time (not reviewed): aes, base64, cbc, chrono, clap, ctrlc, directories, fs2 …",
"category": "external-code",
"hardFail": false
},
{
"id": "F-454d72bc4d6b",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "Cargo.toml",
"line": 9,
"snippet": "repository = \"https://github.com/akitaonrails/ai-usagebar\"",
"message": "URL literal: https://github.com",
"category": "network",
"hardFail": false
},
{
"id": "F-a679cee519b2",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 15,
"snippet": "`omarchy plugin add` on Omarchy 4.",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-fe00c804dda4",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 41,
"snippet": "omarchy pkg aur add ai-usagebar-bin",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-d8f312eef3ab",
"source": "opengrep",
"ruleId": "r.77dfe677dff7",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 41,
"snippet": "omarchy pkg aur add ai-usagebar-bin",
"message": "Installs system packages (pacman / AUR helper / omarchy pkg).",
"category": "package",
"hardFail": false
},
{
"id": "F-bc1d5e0ce1a6",
"source": "textscan",
"ruleId": "r.f93d25679c59",
"severity": "info",
"confidence": 1.0,
"path": "README.md",
"line": 41,
"snippet": "omarchy pkg aur add ai-usagebar-bin",
"message": "System package referenced for install: ai-usagebar-bin (aur)",
"category": "package",
"hardFail": false
},
{
"id": "F-ef450243f895",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 42,
"snippet": "omarchy plugin add https://github.com/akitaonrails/ai-usagebar.git --enable",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-6bb0be0e3b51",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 53,
"snippet": "yay -S ai-usagebar-bin # prebuilt binary from GitHub Releases (fast, ~5s install)",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-b57641c09ce8",
"source": "opengrep",
"ruleId": "r.77dfe677dff7",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 53,
"snippet": "yay -S ai-usagebar-bin # prebuilt binary from GitHub Releases (fast, ~5s install)",
"message": "Installs system packages (pacman / AUR helper / omarchy pkg).",
"category": "package",
"hardFail": false
},
{
"id": "F-7a50e79a4bbf",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 54,
"snippet": "yay -S ai-usagebar # compiles from source (~30-60s, hermetic)",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-48ae9db462b4",
"source": "opengrep",
"ruleId": "r.77dfe677dff7",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 54,
"snippet": "yay -S ai-usagebar # compiles from source (~30-60s, hermetic)",
"message": "Installs system packages (pacman / AUR helper / omarchy pkg).",
"category": "package",
"hardFail": false
},
{
"id": "F-24b05347190e",
"source": "textscan",
"ruleId": "r.f93d25679c59",
"severity": "info",
"confidence": 1.0,
"path": "README.md",
"line": 54,
"snippet": "yay -S ai-usagebar # compiles from source (~30-60s, hermetic)",
"message": "System package referenced for install: ai-usagebar (aur)",
"category": "package",
"hardFail": false
},
{
"id": "F-08f68efcc37e",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 57,
"snippet": "The `-bin` variant downloads the same x86_64 ELF that CI built and tested. The source variant compiles locally with your toolchain. Both install identical binaries to `/usr/bin/`. If you already have one installed, switch with `yay -S` the other package; pacman handles the swap through `conflicts`/`provides`.",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-c68469c5ff60",
"source": "opengrep",
"ruleId": "r.0288ce1d8585",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 62,
"snippet": "cargo install ai-usagebar # compile from source (needs rustup)",
"message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).",
"category": "package",
"hardFail": false
},
{
"id": "F-5380c3ed18a8",
"source": "opengrep",
"ruleId": "r.35725ec3d681",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 72,
"snippet": "sudo make install # → /usr/local/bin",
"message": "Runs commands as root via sudo/doas/run0.",
"category": "privilege",
"hardFail": false
},
{
"id": "F-682b45cdb73a",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 347,
"snippet": "omarchy plugin update akitaonrails.ai-usagebar",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-0f0b139c1655",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 348,
"snippet": "omarchy plugin remove akitaonrails.ai-usagebar",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-6ec3aab8b925",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 704,
"snippet": "# ai-usagebar TUI — float + center + fixed size. omarchy-launch-tui sets the",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-0d67e9e8f2da",
"source": "opengrep",
"ruleId": "r.a6508187cdf9",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 712,
"snippet": "Then `hyprctl reload` (no logout needed).",
"message": "Dispatches Hyprland actions (controls windows/workspaces/keybinds).",
"category": "other",
"hardFail": false
},
{
"id": "F-c18239b2ea34",
"source": "opengrep",
"ruleId": "r.60ddc78b4162",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 712,
"snippet": "Then `hyprctl reload` (no logout needed).",
"message": "Talks to the Hyprland compositor (hyprctl / IPC socket / Quickshell.Hyprland).",
"category": "other",
"hardFail": false
},
{
"id": "F-0794679f7ee9",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 714,
"snippet": "> Omarchy tags a hardcoded list of TUI app-ids with `floating-window` in `~/.local/share/omarchy/default/hypr/apps/system.conf`, which then applies `float + center + size 875 600`. The rules above set those values directly, so the size is deterministic regardless of which config is sourced first. If you launch the TUI differently (e.g. `kitty -e ai-usagebar-tui`), replace the class regex with what",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-c88e90e57bc2",
"source": "opengrep",
"ruleId": "r.60ddc78b4162",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 714,
"snippet": "> Omarchy tags a hardcoded list of TUI app-ids with `floating-window` in `~/.local/share/omarchy/default/hypr/apps/system.conf`, which then applies `float + center + size 875 600`. The rules above set those values directly, so the size is deterministic regardless of which config is sourced first. If you launch the TUI differently (e.g. `kitty -e ai-usagebar-tui`), replace the class regex with what",
"message": "Talks to the Hyprland compositor (hyprctl / IPC socket / Quickshell.Hyprland).",
"category": "other",
"hardFail": false
},
{
"id": "F-ffcd28232804",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "README.md",
"line": 927,
"snippet": "- Auto-merges with the active Omarchy theme at `~/.config/omarchy/current/theme/colors.toml`.",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-72d594b4239c",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "config.example.toml",
"line": 60,
"snippet": "# Defaults to the store claude-acc creates (https://github.com/ohmaseclaro/claude-acc);",
"message": "URL literal: https://github.com",
"category": "network",
"hardFail": false
},
{
"id": "F-fae2841d18bb",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "config.example.toml",
"line": 77,
"snippet": "# https://platform.claude.com/docs/en/manage-claude/usage-cost-api",
"message": "URL literal: https://platform.claude.com",
"category": "network",
"hardFail": false
},
{
"id": "F-6729672a82bd",
"source": "opengrep",
"ruleId": "r.0288ce1d8585",
"severity": "info",
"confidence": 0.9,
"path": "gnome-extension/README.md",
"line": 34,
"snippet": "path in preferences). Install it with `cargo install ai-usagebar` or from",
"message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).",
"category": "package",
"hardFail": false
},
{
"id": "F-228a186e392b",
"source": "malcontent",
"ruleId": "r.e764edde6b0e",
"severity": "info",
"confidence": 0.6,
"path": "gnome-extension/extension.js",
"line": 0,
"snippet": "['./marker-logic']",
"message": "references and possibly executes relative path [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-d3d1d598b969",
"source": "malcontent",
"ruleId": "r.b422e837e9e7",
"severity": "info",
"confidence": 0.6,
"path": "gnome-extension/install.sh",
"line": 0,
"snippet": "['rm -rf']",
"message": "Forcibly deletes files recursively [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-22e644876592",
"source": "opengrep",
"ruleId": "r.908f9c86757d",
"severity": "info",
"confidence": 0.9,
"path": "gnome-extension/install.sh",
"line": 31,
"snippet": "echo \"Logs: journalctl -f -o cat /usr/bin/gnome-shell\"",
"message": "Uses systemd tooling.",
"category": "other",
"hardFail": false
},
{
"id": "F-bc8ca7f997c9",
"source": "perf",
"ruleId": "r.3b120065ac8b",
"severity": "info",
"confidence": 1.0,
"path": "gnome-extension/install.sh",
"line": 31,
"snippet": "journalctl -f",
"message": "Long-running follower/event stream process.",
"category": "performance",
"hardFail": false
},
{
"id": "F-00d7b8babad3",
"source": "malcontent",
"ruleId": "r.e764edde6b0e",
"severity": "info",
"confidence": 0.6,
"path": "gnome-extension/marker-logic.test.mjs",
"line": 0,
"snippet": "['./marker-logic']",
"message": "references and possibly executes relative path [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-707741780d31",
"source": "eslint",
"ruleId": "r.21d921614df3",
"severity": "info",
"confidence": 0.6,
"path": "gnome-extension/marker-logic.test.mjs",
"line": 115,
"snippet": "",
"message": "Generic Object Injection Sink",
"category": "exec",
"hardFail": false
},
{
"id": "F-615127b9001d",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "gnome-extension/metadata.json",
"line": 4,
"snippet": "\"description\": \"Claude, Codex, and other AI plan usage in the GNOME top panel, next to the clock/network: quota bars with the full tooltip in a native dropdown. Backed by the `ai-usagebar` binary (htt",
"message": "URL literal: https://github.com",
"category": "network",
"hardFail": false
},
{
"id": "F-05436db00380",
"source": "malcontent",
"ruleId": "r.1efae2d4d298",
"severity": "info",
"confidence": 0.6,
"path": "gnome-extension/prefs.js",
"line": 0,
"snippet": "[\"'bash'\"]",
"message": "executes shell [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-27e04531711a",
"source": "malcontent",
"ruleId": "r.0a992cf3dce0",
"severity": "info",
"confidence": 0.6,
"path": "gnome-extension/prefs.js",
"line": 0,
"snippet": "['>/dev/null 2>&1']",
"message": "Runs shell commands but throws output away [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-a6836448fd3c",
"source": "malcontent",
"ruleId": "r.c69c96401225",
"severity": "info",
"confidence": 0.6,
"path": "gnome-extension/prefs.js",
"line": 0,
"snippet": "['sudo is needed even when the']",
"message": "calls sudo [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-c0163704c740",
"source": "opengrep",
"ruleId": "r.145d7e49b5e9",
"severity": "info",
"confidence": 0.9,
"path": "gnome-extension/prefs.js",
"line": 77,
"snippet": "['kgx', '--', 'bash', '-lc', command],",
"message": "Runs a shell command string via `sh -c`.",
"category": "exec",
"hardFail": false
},
{
"id": "F-6e3a7941ca5e",
"source": "opengrep",
"ruleId": "r.145d7e49b5e9",
"severity": "info",
"confidence": 0.9,
"path": "gnome-extension/prefs.js",
"line": 78,
"snippet": "['gnome-terminal', '--', 'bash', '-lc', command],",
"message": "Runs a shell command string via `sh -c`.",
"category": "exec",
"hardFail": false
},
{
"id": "F-cb63ac414146",
"source": "opengrep",
"ruleId": "r.145d7e49b5e9",
"severity": "info",
"confidence": 0.9,
"path": "gnome-extension/prefs.js",
"line": 79,
"snippet": "['xterm', '-e', 'bash', '-lc', command],",
"message": "Runs a shell command string via `sh -c`.",
"category": "exec",
"hardFail": false
},
{
"id": "F-a42799075481",
"source": "opengrep",
"ruleId": "r.145d7e49b5e9",
"severity": "info",
"confidence": 0.9,
"path": "gnome-extension/prefs.js",
"line": 112,
"snippet": "['bash', '-lc', `command -v ${cli}`],",
"message": "Runs a shell command string via `sh -c`.",
"category": "exec",
"hardFail": false
},
{
"id": "F-5e6df67d720c",
"source": "opengrep",
"ruleId": "r.01e0e842c851",
"severity": "low",
"confidence": 0.7,
"path": "gnome-extension/prefs.js",
"line": 112,
"snippet": "['bash', '-lc', `command -v ${cli}`],",
"message": "Shell command string built by concatenation inside `sh -c` — command injection if any part is untrusted (network data, file names, user input).",
"category": "exec",
"hardFail": false
},
{
"id": "F-f9390b016743",
"source": "opengrep",
"ruleId": "r.0288ce1d8585",
"severity": "info",
"confidence": 0.9,
"path": "macos/INSTALL.md",
"line": 11,
"snippet": "| **`ai-usagebar` binary** | `cargo install ai-usagebar` (lands in `~/.cargo/bin`) |",
"message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).",
"category": "package",
"hardFail": false
},
{
"id": "F-1263ded005de",
"source": "opengrep",
"ruleId": "r.0288ce1d8585",
"severity": "info",
"confidence": 0.9,
"path": "macos/INSTALL.md",
"line": 27,
"snippet": "cargo install ai-usagebar",
"message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).",
"category": "package",
"hardFail": false
},
{
"id": "F-69baa2699d92",
"source": "opengrep",
"ruleId": "r.0288ce1d8585",
"severity": "info",
"confidence": 0.9,
"path": "macos/INSTALL.md",
"line": 106,
"snippet": "| Menu bar shows `⚠ ai` | the binary wasn't found — `cargo install ai-usagebar`, or set its path; it's searched in `~/.cargo/bin`, `/opt/homebrew/bin`, `/usr/local/bin`, then `PATH` |",
"message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).",
"category": "package",
"hardFail": false
},
{
"id": "F-6d7c6fc9e306",
"source": "opengrep",
"ruleId": "r.0288ce1d8585",
"severity": "info",
"confidence": 0.9,
"path": "macos/README.md",
"line": 46,
"snippet": "- The `ai-usagebar` binary on the Mac. Install it with `cargo install ai-usagebar`",
"message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).",
"category": "package",
"hardFail": false
},
{
"id": "F-1fc2f41e0f97",
"source": "malcontent",
"ruleId": "r.61ca01356bc1",
"severity": "low",
"confidence": 0.6,
"path": "macos/ai-usagebar-menubar.swift",
"line": 0,
"snippet": "['find-generic-password']",
"message": "Looks up a password from the Keychain [HIGH]",
"category": "other",
"hardFail": false
},
{
"id": "F-68c0ac067a19",
"source": "malcontent",
"ruleId": "r.a5934ed7d04a",
"severity": "info",
"confidence": 0.6,
"path": "macos/ai-usagebar-menubar.swift",
"line": 0,
"snippet": "['subprocess']",
"message": "execute external program [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-69f2979fef87",
"source": "malcontent",
"ruleId": "r.ee82497fc5a2",
"severity": "info",
"confidence": 0.6,
"path": "macos/ai-usagebar-menubar.swift",
"line": 0,
"snippet": "['osascript']",
"message": "runs osascript [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-073e373b9648",
"source": "malcontent",
"ruleId": "r.1efae2d4d298",
"severity": "info",
"confidence": 0.6,
"path": "macos/ai-usagebar-menubar.swift",
"line": 0,
"snippet": "['/bin/bash']",
"message": "executes shell [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-346e29b5fea7",
"source": "malcontent",
"ruleId": "r.0a992cf3dce0",
"severity": "info",
"confidence": 0.6,
"path": "macos/ai-usagebar-menubar.swift",
"line": 0,
"snippet": "['>/dev/null 2>&1']",
"message": "Runs shell commands but throws output away [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-ab88eb3f58bc",
"source": "malcontent",
"ruleId": "r.e764edde6b0e",
"severity": "info",
"confidence": 0.6,
"path": "macos/ai-usagebar-menubar.swift",
"line": 0,
"snippet": "['./install-agent']",
"message": "references and possibly executes relative path [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-85397a2c9827",
"source": "malcontent",
"ruleId": "r.cfb405defdf7",
"severity": "info",
"confidence": 0.6,
"path": "macos/ai-usagebar-menubar.swift",
"line": 0,
"snippet": "['/usr/local/bin/']",
"message": "path reference within /usr/local/bin [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-078ee9a07ad6",
"source": "malcontent",
"ruleId": "r.3e359da84e56",
"severity": "info",
"confidence": 0.6,
"path": "macos/ai-usagebar-menubar.swift",
"line": 0,
"snippet": "['agent']",
"message": "references an 'agent' [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-1771770b73bb",
"source": "malcontent",
"ruleId": "r.1bf2a0b4b5c8",
"severity": "info",
"confidence": 0.6,
"path": "macos/ai-usagebar-menubar.swift",
"line": 0,
"snippet": "['/Library/LaunchAgents/', '~/Library/LaunchAgents']",
"message": "sets up a LaunchAgent and launches it [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-33e498f6d282",
"source": "malcontent",
"ruleId": "r.c69c96401225",
"severity": "info",
"confidence": 0.6,
"path": "macos/ai-usagebar-menubar.swift",
"line": 0,
"snippet": "['sudo']",
"message": "calls sudo [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-b7bcbae04d18",
"source": "malcontent",
"ruleId": "r.cb18343e780e",
"severity": "info",
"confidence": 0.6,
"path": "macos/ai-usagebar-menubar.swift",
"line": 0,
"snippet": "['intercepting']",
"message": "References interception [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-7d97413a5273",
"source": "opengrep",
"ruleId": "r.4ef0e1a65284",
"severity": "info",
"confidence": 0.9,
"path": "macos/ai-usagebar-tests.swift",
"line": 632,
"snippet": "let nasty = addAccountScript(binary: \"/b\", label: \"a'; rm -rf ~; echo '\", desktop: false)",
"message": "Recursive delete of the home directory or a top-level config tree.",
"category": "filesystem",
"hardFail": false
},
{
"id": "F-594f5b47a1bc",
"source": "opengrep",
"ruleId": "r.4ef0e1a65284",
"severity": "info",
"confidence": 0.9,
"path": "macos/ai-usagebar-tests.swift",
"line": 633,
"snippet": "assertEqual(nasty.contains(\"rm -rf ~;\\n\"), false, \"injected command stays inside the quotes\")",
"message": "Recursive delete of the home directory or a top-level config tree.",
"category": "filesystem",
"hardFail": false
},
{
"id": "F-c26d98b365b7",
"source": "opengrep",
"ruleId": "r.4ef0e1a65284",
"severity": "info",
"confidence": 0.9,
"path": "macos/ai-usagebar-tests.swift",
"line": 634,
"snippet": "assertEqual(nasty.contains(#\"'a'\\''; rm -rf ~; echo '\\'''\"#), true, \"label is escaped\")",
"message": "Recursive delete of the home directory or a top-level config tree.",
"category": "filesystem",
"hardFail": false
},
{
"id": "F-9f0fc2b06a42",
"source": "malcontent",
"ruleId": "r.3e359da84e56",
"severity": "info",
"confidence": 0.6,
"path": "macos/build.sh",
"line": 0,
"snippet": "['agent']",
"message": "references an 'agent' [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-755aa623ce2c",
"source": "malcontent",
"ruleId": "r.1bf2a0b4b5c8",
"severity": "low",
"confidence": 0.6,
"path": "macos/install-agent.sh",
"line": 0,
"snippet": "['HOME/Library/LaunchAgents/$LABEL.plist', 'ProgramArguments', 'launchctl load']",
"message": "sets up an embedded LaunchAgent and launches it [HIGH]",
"category": "other",
"hardFail": false
},
{
"id": "F-926a9faf2be0",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "macos/install-agent.sh",
"line": 31,
"snippet": "",
"message": "URL literal: http://www.apple.com",
"category": "network",
"hardFail": false
},
{
"id": "F-8fd40d113e4c",
"source": "malcontent",
"ruleId": "r.b422e837e9e7",
"severity": "info",
"confidence": 0.6,
"path": "macos/run-tests.sh",
"line": 0,
"snippet": "['rm -rf']",
"message": "Forcibly deletes files recursively [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-314523f8a39d",
"source": "malcontent",
"ruleId": "r.e764edde6b0e",
"severity": "info",
"confidence": 0.6,
"path": "macos/run-tests.sh",
"line": 0,
"snippet": "['./macos']",
"message": "references and possibly executes relative path [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-89aef16435b0",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/BarWidget.qml",
"line": 44,
"snippet": "if (root.bar) root.bar.run(\"omarchy-launch-floating-terminal-with-presentation ai-usagebar-tui\")",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-e86b0ed70f4c",
"source": "eslint",
"ruleId": "r.21d921614df3",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/Model.js",
"line": 67,
"snippet": "",
"message": "Function Call Object Injection Sink",
"category": "exec",
"hardFail": false
},
{
"id": "F-be7b5765d0ec",
"source": "eslint",
"ruleId": "r.21d921614df3",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/Model.js",
"line": 80,
"snippet": "",
"message": "Function Call Object Injection Sink",
"category": "exec",
"hardFail": false
},
{
"id": "F-0974aa518f8a",
"source": "eslint",
"ruleId": "r.21d921614df3",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/Model.js",
"line": 104,
"snippet": "",
"message": "Function Call Object Injection Sink",
"category": "exec",
"hardFail": false
},
{
"id": "F-b72f3a052d3a",
"source": "eslint",
"ruleId": "r.21d921614df3",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/Model.js",
"line": 139,
"snippet": "",
"message": "Generic Object Injection Sink",
"category": "exec",
"hardFail": false
},
{
"id": "F-3cf613458626",
"source": "eslint",
"ruleId": "r.21d921614df3",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/Model.js",
"line": 148,
"snippet": "",
"message": "Generic Object Injection Sink",
"category": "exec",
"hardFail": false
},
{
"id": "F-71cea425a4ce",
"source": "eslint",
"ruleId": "r.21d921614df3",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/Model.js",
"line": 150,
"snippet": "",
"message": "Generic Object Injection Sink",
"category": "exec",
"hardFail": false
},
{
"id": "F-7ed1930db497",
"source": "eslint",
"ruleId": "r.21d921614df3",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/Model.js",
"line": 159,
"snippet": "",
"message": "Variable Assigned to Object Injection Sink",
"category": "exec",
"hardFail": false
},
{
"id": "F-8198556bb377",
"source": "eslint",
"ruleId": "r.21d921614df3",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/Model.js",
"line": 173,
"snippet": "",
"message": "Variable Assigned to Object Injection Sink",
"category": "exec",
"hardFail": false
},
{
"id": "F-e71be520bbdb",
"source": "eslint",
"ruleId": "r.440b465c2d7c",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/Model.js",
"line": 218,
"snippet": "",
"message": "Unsafe Regular Expression",
"category": "exec",
"hardFail": false
},
{
"id": "F-7ae2caa31397",
"source": "eslint",
"ruleId": "r.21d921614df3",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/Model.js",
"line": 247,
"snippet": "",
"message": "Variable Assigned to Object Injection Sink",
"category": "exec",
"hardFail": false
},
{
"id": "F-18f5e2f07f7b",
"source": "eslint",
"ruleId": "r.21d921614df3",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/Model.js",
"line": 255,
"snippet": "",
"message": "Variable Assigned to Object Injection Sink",
"category": "exec",
"hardFail": false
},
{
"id": "F-57eb843109f6",
"source": "eslint",
"ruleId": "r.21d921614df3",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/Model.js",
"line": 272,
"snippet": "",
"message": "Generic Object Injection Sink",
"category": "exec",
"hardFail": false
},
{
"id": "F-a69b8f0c1a14",
"source": "eslint",
"ruleId": "r.21d921614df3",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/Model.js",
"line": 293,
"snippet": "",
"message": "Generic Object Injection Sink",
"category": "exec",
"hardFail": false
},
{
"id": "F-abc7e08013f2",
"source": "eslint",
"ruleId": "r.21d921614df3",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/Model.js",
"line": 299,
"snippet": "",
"message": "Generic Object Injection Sink",
"category": "exec",
"hardFail": false
},
{
"id": "F-c59bd910d885",
"source": "eslint",
"ruleId": "r.21d921614df3",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/Model.js",
"line": 304,
"snippet": "",
"message": "Generic Object Injection Sink",
"category": "exec",
"hardFail": false
},
{
"id": "F-0b98935aa7bd",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/Panel.qml",
"line": 128,
"snippet": "bar.run(\"omarchy-launch-floating-terminal-with-presentation ai-usagebar-tui\")",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-a221d57df5e5",
"source": "opengrep",
"ruleId": "r.773ca74ce5dc",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/Panel.qml",
"line": 204,
"snippet": "Process {",
"message": "Quickshell Process — spawns external programs.",
"category": "exec",
"hardFail": false
},
{
"id": "F-9df0e6be422e",
"source": "extcode",
"ruleId": "r.5b0c49abe65e",
"severity": "medium",
"confidence": 0.8,
"path": "omarchy/Panel.qml",
"line": 207,
"snippet": "command: [\"ai-usagebar\", \"usage\", \"--json\"]",
"message": "Runs 'ai-usagebar', which is not in the repository or the Omarchy base install: its code was not reviewed (installed separately, e.g. from the AUR).",
"category": "external-code",
"hardFail": false
},
{
"id": "F-aecc17b41ba0",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/README.md",
"line": 18,
"snippet": "omarchy pkg aur add ai-usagebar-bin",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-f0041a8ff853",
"source": "opengrep",
"ruleId": "r.77dfe677dff7",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/README.md",
"line": 18,
"snippet": "omarchy pkg aur add ai-usagebar-bin",
"message": "Installs system packages (pacman / AUR helper / omarchy pkg).",
"category": "package",
"hardFail": false
},
{
"id": "F-edcce107df19",
"source": "textscan",
"ruleId": "r.f93d25679c59",
"severity": "info",
"confidence": 1.0,
"path": "omarchy/README.md",
"line": 18,
"snippet": "omarchy pkg aur add ai-usagebar-bin",
"message": "System package referenced for install: ai-usagebar-bin (aur)",
"category": "package",
"hardFail": false
},
{
"id": "F-21b9a5ced88d",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/README.md",
"line": 19,
"snippet": "omarchy plugin add https://github.com/akitaonrails/ai-usagebar.git --enable",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-13533d421c17",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/README.md",
"line": 22,
"snippet": "Omarchy clones plugin repositories into `~/.config/omarchy/plugins/`. The root",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-fc45004faf27",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/README.md",
"line": 28,
"snippet": "omarchy plugin update akitaonrails.ai-usagebar",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-57875277e81b",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/README.md",
"line": 29,
"snippet": "omarchy plugin remove akitaonrails.ai-usagebar",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-b2be94187944",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/README.md",
"line": 39,
"snippet": "- Shell: `omarchy-shell shell summon akitaonrails.ai-usagebar '{}'` opens the",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-04d0b3f60a29",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/README.md",
"line": 40,
"snippet": "panel and `omarchy-shell shell hide akitaonrails.ai-usagebar` closes it.",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-f01e868bcf12",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/README.md",
"line": 64,
"snippet": "The plugin's display-only options remain in `~/.config/omarchy/shell.json` and",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-127c2ec2f3b3",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/README.md",
"line": 88,
"snippet": "omarchy plugin validate .",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-7226c8b0a027",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/README.md",
"line": 89,
"snippet": "qmllint -U -I /usr/share/omarchy/shell omarchy/BarWidget.qml omarchy/Panel.qml omarchy/SettingsView.qml",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-64d9fb544f60",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/README.md",
"line": 94,
"snippet": "reload. In a source checkout, rerun `omarchy plugin validate .` after changing",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-b822db682cf8",
"source": "opengrep",
"ruleId": "r.773ca74ce5dc",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/SettingsView.qml",
"line": 139,
"snippet": "Process {",
"message": "Quickshell Process — spawns external programs.",
"category": "exec",
"hardFail": false
},
{
"id": "F-a699d00a7837",
"source": "opengrep",
"ruleId": "r.773ca74ce5dc",
"severity": "info",
"confidence": 0.9,
"path": "omarchy/SettingsView.qml",
"line": 158,
"snippet": "Process {",
"message": "Quickshell Process — spawns external programs.",
"category": "exec",
"hardFail": false
},
{
"id": "F-cc336e1bead4",
"source": "ai",
"ruleId": "r.3ced4e1cd7e6",
"severity": "low",
"confidence": 0.6,
"path": "omarchy/SettingsView.qml",
"line": 161,
"snippet": "command: [\"ai-usagebar\", \"settings\", \"apply\"]",
"message": "Settings apply passes API keys to the external ai-usagebar CLI, which is not reviewed.",
"category": "secret",
"hardFail": false
},
{
"id": "F-76623e92ec9f",
"source": "malcontent",
"ruleId": "r.98f4a8002aa3",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/model.test.mjs",
"line": 0,
"snippet": "['line spoofright-to-left', 'nspoof']",
"message": "references spoofing [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-1a10da801101",
"source": "eslint",
"ruleId": "r.91ce6a8cb27c",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/model.test.mjs",
"line": 5,
"snippet": "",
"message": "Found readFileSync from package \"node:fs\" with non literal argument at index 0",
"category": "exec",
"hardFail": false
},
{
"id": "F-82a74b4294b2",
"source": "eslint",
"ruleId": "r.91ce6a8cb27c",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/model.test.mjs",
"line": 13,
"snippet": "",
"message": "Found readFileSync from package \"node:fs\" with non literal argument at index 0",
"category": "exec",
"hardFail": false
},
{
"id": "F-845535df4c54",
"source": "eslint",
"ruleId": "r.91ce6a8cb27c",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/model.test.mjs",
"line": 17,
"snippet": "",
"message": "Found readFileSync from package \"node:fs\" with non literal argument at index 0",
"category": "exec",
"hardFail": false
},
{
"id": "F-1d490e875e82",
"source": "eslint",
"ruleId": "r.a119b15bdcd5",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/model.test.mjs",
"line": 20,
"snippet": "",
"message": "Found non-literal argument to RegExp Constructor",
"category": "exec",
"hardFail": false
},
{
"id": "F-1193b5e6c0ec",
"source": "eslint",
"ruleId": "r.91ce6a8cb27c",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/model.test.mjs",
"line": 26,
"snippet": "",
"message": "Found readFileSync from package \"node:fs\" with non literal argument at index 0",
"category": "exec",
"hardFail": false
},
{
"id": "F-e5b9124d8c8a",
"source": "eslint",
"ruleId": "r.91ce6a8cb27c",
"severity": "info",
"confidence": 0.6,
"path": "omarchy/model.test.mjs",
"line": 33,
"snippet": "",
"message": "Found readFileSync from package \"node:fs\" with non literal argument at index 0",
"category": "exec",
"hardFail": false
},
{
"id": "F-d8ce6ffbb2d3",
"source": "opengrep",
"ruleId": "r.cce82e3e2863",
"severity": "info",
"confidence": 0.9,
"path": "packaging/aur/PKGBUILD-bin",
"line": 26,
"snippet": "# Per-arch sources — pacman picks the matching one for the host arch.",
"message": "Uses pacman / AUR helpers.",
"category": "other",
"hardFail": false
},
{
"id": "F-f48c5368be63",
"source": "malcontent",
"ruleId": "r.61ca01356bc1",
"severity": "info",
"confidence": 0.6,
"path": "src/account.rs",
"line": 0,
"snippet": "['Keychain']",
"message": "accesses a keychain [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-818edc76cd12",
"source": "malcontent",
"ruleId": "r.8a2d19128690",
"severity": "info",
"confidence": 0.6,
"path": "src/account.rs",
"line": 0,
"snippet": "['/accounts/work/.credentials.json']",
"message": "possible hidden file path [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-c5d9678e159c",
"source": "malcontent",
"ruleId": "r.a5934ed7d04a",
"severity": "info",
"confidence": 0.6,
"path": "src/account.rs",
"line": 0,
"snippet": "['subprocess']",
"message": "execute external program [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-2ac25c294c6d",
"source": "malcontent",
"ruleId": "r.1ede94bd4987",
"severity": "info",
"confidence": 0.6,
"path": "src/account.rs",
"line": 0,
"snippet": "['cookies']",
"message": "may access cookies [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-746e3f367049",
"source": "malcontent",
"ruleId": "r.f096078dc3a9",
"severity": "info",
"confidence": 0.6,
"path": "src/account.rs",
"line": 0,
"snippet": "['/tmp/Claude']",
"message": "path reference within /tmp [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-ce2f1a94e20e",
"source": "malcontent",
"ruleId": "r.61ca01356bc1",
"severity": "info",
"confidence": 0.6,
"path": "src/anthropic/cli_account.rs",
"line": 0,
"snippet": "['Keychain', 'keychain']",
"message": "accesses a keychain [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-9add164fc0f8",
"source": "malcontent",
"ruleId": "r.f096078dc3a9",
"severity": "info",
"confidence": 0.6,
"path": "src/anthropic/cli_account.rs",
"line": 0,
"snippet": "['/tmp/x']",
"message": "references an unusual path within /tmp [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-8e9e8fcef0ae",
"source": "malcontent",
"ruleId": "r.61ca01356bc1",
"severity": "info",
"confidence": 0.6,
"path": "src/anthropic/creds.rs",
"line": 0,
"snippet": "['Keychain', 'keychain']",
"message": "accesses a keychain [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-f58f073d0a4a",
"source": "malcontent",
"ruleId": "r.e60d04e04200",
"severity": "info",
"confidence": 0.6,
"path": "src/anthropic/creds.rs",
"line": 0,
"snippet": "['USERPROFILE', 'Desktop']",
"message": "Looks up the Desktop directory for the current user [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-ee79901b5a98",
"source": "malcontent",
"ruleId": "r.a5934ed7d04a",
"severity": "info",
"confidence": 0.6,
"path": "src/anthropic/creds.rs",
"line": 0,
"snippet": "['subprocess']",
"message": "execute external program [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-c37cbae2b009",
"source": "malcontent",
"ruleId": "r.ef1ffca5d1bd",
"severity": "info",
"confidence": 0.6,
"path": "src/anthropic/desktop_creds.rs",
"line": 0,
"snippet": "['clientId']",
"message": "contains a client ID [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-e375c0126ba3",
"source": "malcontent",
"ruleId": "r.61ca01356bc1",
"severity": "info",
"confidence": 0.6,
"path": "src/anthropic/desktop_creds.rs",
"line": 0,
"snippet": "['Keychain']",
"message": "accesses a keychain [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-86f7e0a23232",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/anthropic/desktop_creds.rs",
"line": 363,
"snippet": "\"9d1c250a:org:https://api.anthropic.com:user:inference user:profile\": {",
"message": "URL literal: https://api.anthropic.com",
"category": "network",
"hardFail": false
},
{
"id": "F-f22bb73bd7cf",
"source": "malcontent",
"ruleId": "r.61ca01356bc1",
"severity": "info",
"confidence": 0.6,
"path": "src/anthropic/fetch.rs",
"line": 0,
"snippet": "['Keychain']",
"message": "accesses a keychain [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-7cc12b4a0b1d",
"source": "malcontent",
"ruleId": "r.8d917b297212",
"severity": "info",
"confidence": 0.6,
"path": "src/anthropic/fetch.rs",
"line": 0,
"snippet": "['application/json', 'POST']",
"message": "upload content via HTTP form [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-da38207799d7",
"source": "malcontent",
"ruleId": "r.7f5b9be716d8",
"severity": "info",
"confidence": 0.6,
"path": "src/anthropic/fetch.rs",
"line": 0,
"snippet": "['Content-Type', 'HTTP', 'POST', 'http']",
"message": "submits content to websites [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-087638c52926",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/anthropic/fetch.rs",
"line": 17,
"snippet": "pub const USAGE_URL: &str = \"https://api.anthropic.com/api/oauth/usage\";",
"message": "URL literal: https://api.anthropic.com",
"category": "network",
"hardFail": false
},
{
"id": "F-d6ca150091a1",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/anthropic/fetch.rs",
"line": 436,
"snippet": "usage: \"http://localhost:1/should-not-be-called\".into(),",
"message": "URL literal: http://localhost",
"category": "network",
"hardFail": false
},
{
"id": "F-8a091eab6eac",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/anthropic/fetch.rs",
"line": 616,
"snippet": "usage: \"http://127.0.0.1:1/api/oauth/usage\".into(),",
"message": "URL literal: http://127.0.0.1",
"category": "network",
"hardFail": false
},
{
"id": "F-ae677f521f5f",
"source": "malcontent",
"ruleId": "r.61ca01356bc1",
"severity": "low",
"confidence": 0.6,
"path": "src/anthropic/keychain.rs",
"line": 0,
"snippet": "['find-generic-password']",
"message": "Looks up a password from the Keychain [HIGH]",
"category": "other",
"hardFail": false
},
{
"id": "F-75239c39b67a",
"source": "malcontent",
"ruleId": "r.1efae2d4d298",
"severity": "info",
"confidence": 0.6,
"path": "src/anthropic/keychain.rs",
"line": 0,
"snippet": "['/bin/sh']",
"message": "executes shell [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-f3883a78d4fd",
"source": "malcontent",
"ruleId": "r.61ca01356bc1",
"severity": "info",
"confidence": 0.6,
"path": "src/anthropic/mod.rs",
"line": 0,
"snippet": "['keychain']",
"message": "accesses a keychain [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-bc2cc5406151",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/anthropic/mod.rs",
"line": 2,
"snippet": "//! `https://api.anthropic.com/api/oauth/usage` endpoint.",
"message": "URL literal: https://api.anthropic.com",
"category": "network",
"hardFail": false
},
{
"id": "F-eaa2b5241a0a",
"source": "malcontent",
"ruleId": "r.ef1ffca5d1bd",
"severity": "info",
"confidence": 0.6,
"path": "src/anthropic/oauth.rs",
"line": 0,
"snippet": "['client_id']",
"message": "contains a client ID [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-132cb049ba0d",
"source": "malcontent",
"ruleId": "r.8d917b297212",
"severity": "info",
"confidence": 0.6,
"path": "src/anthropic/oauth.rs",
"line": 0,
"snippet": "['application/json', 'POST', 'post']",
"message": "upload content via HTTP form [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-8e9eb76e4d0b",
"source": "malcontent",
"ruleId": "r.7f5b9be716d8",
"severity": "info",
"confidence": 0.6,
"path": "src/anthropic/oauth.rs",
"line": 0,
"snippet": "['Content-Type', 'POST', 'http']",
"message": "submits content to websites [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-fd781f6473a6",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/anthropic/oauth.rs",
"line": 1,
"snippet": "//! OAuth token refresh — POST `https://platform.claude.com/v1/oauth/token`.",
"message": "URL literal: https://platform.claude.com",
"category": "network",
"hardFail": false
},
{
"id": "F-eaabed1238d0",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/anthropic_api/fetch.rs",
"line": 20,
"snippet": "pub const BASE_URL: &str = \"https://api.anthropic.com\";",
"message": "URL literal: https://api.anthropic.com",
"category": "network",
"hardFail": false
},
{
"id": "F-81cd713f7de8",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/anthropic_api/types.rs",
"line": 5,
"snippet": "//! ():",
"message": "URL literal: https://platform.claude.com",
"category": "network",
"hardFail": false
},
{
"id": "F-0e45e651d1b3",
"source": "malcontent",
"ruleId": "r.23a5406365c9",
"severity": "info",
"confidence": 0.6,
"path": "src/antigravity/fetch.rs",
"line": 0,
"snippet": "['https://', 'http://', 'windows', 'Linux', 'linux', 'macOS', 'macos']",
"message": "references multiple operating systems [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-c39b196c4751",
"source": "malcontent",
"ruleId": "r.98f35183c638",
"severity": "info",
"confidence": 0.6,
"path": "src/antigravity/fetch.rs",
"line": 0,
"snippet": "['sshd']",
"message": "Mentions SSHD [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-83585808284c",
"source": "malcontent",
"ruleId": "r.8a2d19128690",
"severity": "info",
"confidence": 0.6,
"path": "src/antigravity/fetch.rs",
"line": 0,
"snippet": "['/home/u/.local']",
"message": "possible hidden file path [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-d0d6e658e99f",
"source": "malcontent",
"ruleId": "r.8d917b297212",
"severity": "info",
"confidence": 0.6,
"path": "src/antigravity/fetch.rs",
"line": 0,
"snippet": "['application/json', 'POST', 'post']",
"message": "upload content via HTTP form [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-3b096104e762",
"source": "malcontent",
"ruleId": "r.7f5b9be716d8",
"severity": "info",
"confidence": 0.6,
"path": "src/antigravity/fetch.rs",
"line": 0,
"snippet": "['Content-Type', 'HTTP', 'POST', 'http']",
"message": "submits content to websites [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-b4cd98d07854",
"source": "malcontent",
"ruleId": "r.57128783ca37",
"severity": "info",
"confidence": 0.6,
"path": "src/antigravity/fetch.rs",
"line": 0,
"snippet": "['host:port']",
"message": "connects to an arbitrary host:port [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-7c87b8dabbd2",
"source": "malcontent",
"ruleId": "r.c6ece59a0429",
"severity": "info",
"confidence": 0.6,
"path": "src/antigravity/fetch.rs",
"line": 0,
"snippet": "['listen', 'socket']",
"message": "listen on a socket [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-937370506d28",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/antigravity/fetch.rs",
"line": 403,
"snippet": ".map(|p| format!(\"http://127.0.0.1:{p}\"))",
"message": "URL literal: http://127.0.0.1",
"category": "network",
"hardFail": false
},
{
"id": "F-0ab9336a0286",
"source": "malcontent",
"ruleId": "r.5dc13594e86f",
"severity": "low",
"confidence": 0.6,
"path": "src/cache.rs",
"line": 0,
"snippet": "['yload_refuses_a_payload_older_than_the_', 'fallback_payload_refuses_a_paylo', 'maybe_payload_returns_none_wh', 'fresh_payload_respects_ttl', 'write_payload', 'payload_path', 'read_payload', 'payload",
"message": "payload path [HIGH]",
"category": "other",
"hardFail": false
},
{
"id": "F-8682a705fe92",
"source": "malcontent",
"ruleId": "r.22759d69cf4f",
"severity": "info",
"confidence": 0.6,
"path": "src/claude_desktop/app.rs",
"line": 0,
"snippet": "['LevelDB']",
"message": "accesses LevelDB databases [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-5728dc834e53",
"source": "malcontent",
"ruleId": "r.61ca01356bc1",
"severity": "info",
"confidence": 0.6,
"path": "src/claude_desktop/app.rs",
"line": 0,
"snippet": "['keychain']",
"message": "accesses a keychain [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-170dbda97af6",
"source": "malcontent",
"ruleId": "r.7aa644c08f09",
"severity": "info",
"confidence": 0.6,
"path": "src/claude_desktop/app.rs",
"line": 0,
"snippet": "['pgrep']",
"message": "Finds program in process table [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-511a289fe523",
"source": "malcontent",
"ruleId": "r.ee82497fc5a2",
"severity": "info",
"confidence": 0.6,
"path": "src/claude_desktop/app.rs",
"line": 0,
"snippet": "['osascript']",
"message": "runs osascript [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-91755fc2c882",
"source": "malcontent",
"ruleId": "r.73ac774929b3",
"severity": "info",
"confidence": 0.6,
"path": "src/claude_desktop/app.rs",
"line": 0,
"snippet": "['/usr/bin/open', '/usr/bin/tar']",
"message": "can call /usr/bin/open and archiving tools [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-f1a2e1d98f20",
"source": "malcontent",
"ruleId": "r.1ede94bd4987",
"severity": "info",
"confidence": 0.6,
"path": "src/claude_desktop/app.rs",
"line": 0,
"snippet": "['cookies']",
"message": "may access cookies [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-d6e1aced3979",
"source": "malcontent",
"ruleId": "r.4ed500835adc",
"severity": "info",
"confidence": 0.6,
"path": "src/claude_desktop/app.rs",
"line": 0,
"snippet": "['/Applications/Claude.app/Contents/MacOS/Claude']",
"message": "references hardcoded application path [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-563d405087f8",
"source": "malcontent",
"ruleId": "r.bd0dc86cbeb5",
"severity": "info",
"confidence": 0.6,
"path": "src/claude_desktop/app.rs",
"line": 0,
"snippet": "['chmod']",
"message": "modifies file permissions [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-089674109c29",
"source": "malcontent",
"ruleId": "r.22759d69cf4f",
"severity": "info",
"confidence": 0.6,
"path": "src/claude_desktop/capture.rs",
"line": 0,
"snippet": "['leveldb']",
"message": "accesses LevelDB databases [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-0879f89d266a",
"source": "malcontent",
"ruleId": "r.1ede94bd4987",
"severity": "info",
"confidence": 0.6,
"path": "src/claude_desktop/capture.rs",
"line": 0,
"snippet": "['Cookies', 'cookies']",
"message": "may access cookies [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-c24230d60b6b",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/claude_desktop/capture.rs",
"line": 16,
"snippet": "//! Ported from claude-acc's `add` (),",
"message": "URL literal: https://github.com",
"category": "network",
"hardFail": false
},
{
"id": "F-c4d37814cde6",
"source": "malcontent",
"ruleId": "r.f096078dc3a9",
"severity": "info",
"confidence": 0.6,
"path": "src/claude_desktop/merge.rs",
"line": 0,
"snippet": "['/tmp/demo']",
"message": "path reference within /tmp [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-4e258daa1117",
"source": "malcontent",
"ruleId": "r.22759d69cf4f",
"severity": "info",
"confidence": 0.6,
"path": "src/claude_desktop/mod.rs",
"line": 0,
"snippet": "['LEVELDB_DIRS', 'LevelDB', 'leveldb']",
"message": "accesses LevelDB databases [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-c538adb0aeeb",
"source": "malcontent",
"ruleId": "r.1ede94bd4987",
"severity": "info",
"confidence": 0.6,
"path": "src/claude_desktop/mod.rs",
"line": 0,
"snippet": "['Cookies', 'cookies']",
"message": "may access cookies [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-cefe99a2ef6a",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/claude_desktop/mod.rs",
"line": 10,
"snippet": "//! reverse-engineered by **claude-acc** (,",
"message": "URL literal: https://github.com",
"category": "network",
"hardFail": false
},
{
"id": "F-a655b233b874",
"source": "malcontent",
"ruleId": "r.23a5406365c9",
"severity": "info",
"confidence": 0.6,
"path": "src/config.rs",
"line": 0,
"snippet": "['https://', 'Windows', 'windows', 'Linux', 'macOS']",
"message": "references multiple operating systems [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-05963d02fa8f",
"source": "malcontent",
"ruleId": "r.28ce290c9d3f",
"severity": "info",
"confidence": 0.6,
"path": "src/config.rs",
"line": 0,
"snippet": "['sqlite3']",
"message": "accesses SQLite databases [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-1e03bed24b45",
"source": "malcontent",
"ruleId": "r.61ca01356bc1",
"severity": "info",
"confidence": 0.6,
"path": "src/config.rs",
"line": 0,
"snippet": "['Keychain', 'keychain']",
"message": "accesses a keychain [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-322732ac8f2f",
"source": "malcontent",
"ruleId": "r.8a2d19128690",
"severity": "info",
"confidence": 0.6,
"path": "src/config.rs",
"line": 0,
"snippet": "['/tmp/accounts/personal/.credentials.json', '/tmp/accounts/work/.credentials.json', '/other/.credentials.json', '/home/u/.config']",
"message": "possible hidden file path [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-d4bc81cff6da",
"source": "malcontent",
"ruleId": "r.25aa09c9f7e1",
"severity": "info",
"confidence": 0.6,
"path": "src/config.rs",
"line": 0,
"snippet": "['/etc/hosts']",
"message": "references /etc/hosts [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-d3ebd6ff733b",
"source": "malcontent",
"ruleId": "r.f096078dc3a9",
"severity": "info",
"confidence": 0.6,
"path": "src/config.rs",
"line": 0,
"snippet": "['/tmp/accounts/personal/.credentials.json', '/tmp/accounts/work/.credentials.json', '/tmp/does-not-exist-ai-usagebar-test']",
"message": "path reference within /tmp [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-bdf77c36d563",
"source": "malcontent",
"ruleId": "r.d5d304b1ed90",
"severity": "info",
"confidence": 0.6,
"path": "src/config.rs",
"line": 0,
"snippet": "['/Users/me']",
"message": "references path within /Users [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-30206f1a32c3",
"source": "malcontent",
"ruleId": "r.bd0dc86cbeb5",
"severity": "info",
"confidence": 0.6,
"path": "src/config.rs",
"line": 0,
"snippet": "['Chmod']",
"message": "modifies file permissions [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-6dafe8c2fb28",
"source": "malcontent",
"ruleId": "r.3e359da84e56",
"severity": "info",
"confidence": 0.6,
"path": "src/config.rs",
"line": 0,
"snippet": "['agent_auth_path', 'default_agent', 'cursor_agent']",
"message": "references an 'agent' [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-b1acc5717c6b",
"source": "malcontent",
"ruleId": "r.98f4a8002aa3",
"severity": "info",
"confidence": 0.6,
"path": "src/config.rs",
"line": 0,
"snippet": "['spoof terminal output']",
"message": "references spoofing [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-9ffd4dbd7a0e",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/config.rs",
"line": 181,
"snippet": "/// () creates — `account switch`",
"message": "URL literal: https://github.com",
"category": "network",
"hardFail": false
},
{
"id": "F-ad597efba944",
"source": "malcontent",
"ruleId": "r.3e359da84e56",
"severity": "info",
"confidence": 0.6,
"path": "src/context/mod.rs",
"line": 0,
"snippet": "['Subagent', 'subagent']",
"message": "references an 'agent' [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-e74909757302",
"source": "malcontent",
"ruleId": "r.21649a357848",
"severity": "info",
"confidence": 0.6,
"path": "src/cursor/db.rs",
"line": 0,
"snippet": "['base64_shell_encode::| base64']",
"message": "calls base64 command to encode strings [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-038b06d6d13c",
"source": "malcontent",
"ruleId": "r.3e359da84e56",
"severity": "info",
"confidence": 0.6,
"path": "src/cursor/db.rs",
"line": 0,
"snippet": "['ide_db_with_the_agent', 'agent_access_token', 'surfaces_the_agent', 'back_to_the_agent', 'agent_auth_path', 'default_agent', 'agent_file', 'agent_path', 'read_agent']",
"message": "references an 'agent' [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-42a001dd853c",
"source": "malcontent",
"ruleId": "r.3e359da84e56",
"severity": "info",
"confidence": 0.6,
"path": "src/cursor/fetch.rs",
"line": 0,
"snippet": "['agent_auth_path', 'agent_path', 'no_agent']",
"message": "references an 'agent' [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-222d9220f8f2",
"source": "malcontent",
"ruleId": "r.35e4fb839116",
"severity": "info",
"confidence": 0.6,
"path": "src/cursor/fetch.rs",
"line": 0,
"snippet": "['Cookie', 'HTTP']",
"message": "access HTTP resources using cookies [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-56de39695316",
"source": "malcontent",
"ruleId": "r.0f11e0c0e16d",
"severity": "info",
"confidence": 0.6,
"path": "src/cursor/fetch.rs",
"line": 0,
"snippet": "['(KHTML, like Gecko) Chrome']",
"message": "pretends to be Chrome [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-7eb827f40213",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/cursor/fetch.rs",
"line": 18,
"snippet": "pub const BASE_URL: &str = \"https://cursor.com\";",
"message": "URL literal: https://cursor.com",
"category": "network",
"hardFail": false
},
{
"id": "F-3c53cbef219c",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/deepseek/fetch.rs",
"line": 11,
"snippet": "pub const BASE_URL: &str = \"https://api.deepseek.com\";",
"message": "URL literal: https://api.deepseek.com",
"category": "network",
"hardFail": false
},
{
"id": "F-0a12680ce3fb",
"source": "malcontent",
"ruleId": "r.98f4a8002aa3",
"severity": "info",
"confidence": 0.6,
"path": "src/display.rs",
"line": 0,
"snippet": "['column returnspoof']",
"message": "references spoofing [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-e961224e2a20",
"source": "malcontent",
"ruleId": "r.33e4b7993b69",
"severity": "info",
"confidence": 0.6,
"path": "src/error.rs",
"line": 0,
"snippet": "['connect']",
"message": "initiate a connection on a socket [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-06d2d33a0c66",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/grok/fetch.rs",
"line": 15,
"snippet": "pub const BASE_URL: &str = \"https://management-api.x.ai\";",
"message": "URL literal: https://management-api.x.ai",
"category": "network",
"hardFail": false
},
{
"id": "F-2a44186da8d4",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/grok/types.rs",
"line": 4,
"snippet": "//! ():",
"message": "URL literal: https://docs.x.ai",
"category": "network",
"hardFail": false
},
{
"id": "F-09911851043b",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/kilo/fetch.rs",
"line": 15,
"snippet": "pub const BASE_URL: &str = \"https://api.kilo.ai\";",
"message": "URL literal: https://api.kilo.ai",
"category": "network",
"hardFail": false
},
{
"id": "F-c3b408bb9d68",
"source": "malcontent",
"ruleId": "r.5dc13594e86f",
"severity": "low",
"confidence": 0.6,
"path": "src/kimi/fetch.rs",
"line": 0,
"snippet": "['fallback_payload', 'fresh_payload', 'write_payload', 'payload_path', 'payload_age']",
"message": "payload path [HIGH]",
"category": "other",
"hardFail": false
},
{
"id": "F-effa5afcaaf4",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/kimi/fetch.rs",
"line": 13,
"snippet": "pub const BASE_URL: &str = \"https://api.kimi.com\";",
"message": "URL literal: https://api.kimi.com",
"category": "network",
"hardFail": false
},
{
"id": "F-073bf0768593",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/kimi/fetch.rs",
"line": 540,
"snippet": "usages: \"http://localhost:1/coding/v1/usages\".into(),",
"message": "URL literal: http://localhost",
"category": "network",
"hardFail": false
},
{
"id": "F-3a92320e79a9",
"source": "malcontent",
"ruleId": "r.ef1ffca5d1bd",
"severity": "info",
"confidence": 0.6,
"path": "src/kiro/db.rs",
"line": 0,
"snippet": "['client_id']",
"message": "contains a client ID [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-4c5c9cede7a0",
"source": "malcontent",
"ruleId": "r.28ce290c9d3f",
"severity": "info",
"confidence": 0.6,
"path": "src/kiro/db.rs",
"line": 0,
"snippet": "['sqlite3']",
"message": "accesses SQLite databases [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-c1b535e8d273",
"source": "gitleaks",
"ruleId": "r.43cd6c2d96bb",
"severity": "low",
"confidence": 0.7,
"path": "src/kiro/db.rs",
"line": 400,
"snippet": "one.account_key, \"RED…REDACTED\"",
"message": "Possible hard-coded secret (Detected a Generic API Key, potentially exposing access to various services and sensitive operations.); value redacted, liveness not verified.",
"category": "secret",
"hardFail": false
},
{
"id": "F-0038af606c49",
"source": "malcontent",
"ruleId": "r.ef1ffca5d1bd",
"severity": "info",
"confidence": 0.6,
"path": "src/kiro/fetch.rs",
"line": 0,
"snippet": "['client_id', 'clientId']",
"message": "contains a client ID [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-e0659f9b833b",
"source": "malcontent",
"ruleId": "r.28ce290c9d3f",
"severity": "info",
"confidence": 0.6,
"path": "src/kiro/fetch.rs",
"line": 0,
"snippet": "['sqlite3']",
"message": "accesses SQLite databases [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-ccb05fef89f3",
"source": "malcontent",
"ruleId": "r.7f5b9be716d8",
"severity": "info",
"confidence": 0.6,
"path": "src/kiro/fetch.rs",
"line": 0,
"snippet": "['Content-Type', 'HTTP', 'POST', 'http']",
"message": "submits content to websites [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-a7e3b21d7a0a",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/kiro/fetch.rs",
"line": 750,
"snippet": "// \"http://127.0.0.1:1\" endpoint is a canary — the test would fail",
"message": "URL literal: http://127.0.0.1",
"category": "network",
"hardFail": false
},
{
"id": "F-0a5578eb13a3",
"source": "malcontent",
"ruleId": "r.ef1ffca5d1bd",
"severity": "info",
"confidence": 0.6,
"path": "src/kiro/oauth.rs",
"line": 0,
"snippet": "['client_id', 'clientId']",
"message": "contains a client ID [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-2556566f0935",
"source": "malcontent",
"ruleId": "r.8d917b297212",
"severity": "info",
"confidence": 0.6,
"path": "src/kiro/oauth.rs",
"line": 0,
"snippet": "['application/json', 'POST', 'post']",
"message": "upload content via HTTP form [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-99bd2006aea2",
"source": "malcontent",
"ruleId": "r.7f5b9be716d8",
"severity": "info",
"confidence": 0.6,
"path": "src/kiro/oauth.rs",
"line": 0,
"snippet": "['Content-Type', 'POST', 'http']",
"message": "submits content to websites [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-4547a43ec67d",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/kiro/oauth.rs",
"line": 3,
"snippet": "//! ),",
"message": "URL literal: https://docs.aws.amazon.com",
"category": "network",
"hardFail": false
},
{
"id": "F-296258cdfe95",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/kiro/oauth.rs",
"line": 171,
"snippet": "\"https://oidc.us-east-1.amazonaws.com/token\"",
"message": "URL literal: https://oidc.us-east-1.amazonaws.com",
"category": "network",
"hardFail": false
},
{
"id": "F-b46ac015dac3",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/kiro/oauth.rs",
"line": 175,
"snippet": "\"https://oidc.us-gov-west-1.amazonaws.com/token\"",
"message": "URL literal: https://oidc.us-gov-west-1.amazonaws.com",
"category": "network",
"hardFail": false
},
{
"id": "F-4a87ce20b8a1",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/kiro/types.rs",
"line": 6,
"snippet": "//! `https://codewhisperer.us-east-1.amazonaws.com/` with `x-amz-target:",
"message": "URL literal: https://codewhisperer.us-east-1.amazonaws.com",
"category": "network",
"hardFail": false
},
{
"id": "F-d909d464fbfe",
"source": "malcontent",
"ruleId": "r.5dc13594e86f",
"severity": "low",
"confidence": 0.6,
"path": "src/minimax/fetch.rs",
"line": 0,
"snippet": "['fallback_payload', 'fresh_payload', 'write_payload', 'payload_path', 'payload_age']",
"message": "payload path [HIGH]",
"category": "other",
"hardFail": false
},
{
"id": "F-8021c84c7aa7",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/minimax/fetch.rs",
"line": 19,
"snippet": "pub const BASE_GLOBAL: &str = \"https://api.minimax.io\";",
"message": "URL literal: https://api.minimax.io",
"category": "network",
"hardFail": false
},
{
"id": "F-8d3aeccfabfc",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/minimax/fetch.rs",
"line": 20,
"snippet": "pub const BASE_CN: &str = \"https://api.minimaxi.com\";",
"message": "URL literal: https://api.minimaxi.com",
"category": "network",
"hardFail": false
},
{
"id": "F-e218c2244502",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/moonshot/fetch.rs",
"line": 15,
"snippet": "pub const BASE_GLOBAL: &str = \"https://api.moonshot.ai\";",
"message": "URL literal: https://api.moonshot.ai",
"category": "network",
"hardFail": false
},
{
"id": "F-ca6a03f7195b",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/moonshot/fetch.rs",
"line": 16,
"snippet": "pub const BASE_CN: &str = \"https://api.moonshot.cn\";",
"message": "URL literal: https://api.moonshot.cn",
"category": "network",
"hardFail": false
},
{
"id": "F-a63a94cd6564",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/novita/fetch.rs",
"line": 14,
"snippet": "pub const BASE_URL: &str = \"https://api.novita.ai\";",
"message": "URL literal: https://api.novita.ai",
"category": "network",
"hardFail": false
},
{
"id": "F-7bb1d950fcc8",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/novita/types.rs",
"line": 4,
"snippet": "//! (): every",
"message": "URL literal: https://novita.ai",
"category": "network",
"hardFail": false
},
{
"id": "F-b3904d868f11",
"source": "malcontent",
"ruleId": "r.23a5406365c9",
"severity": "info",
"confidence": 0.6,
"path": "src/openai/creds.rs",
"line": 0,
"snippet": "['https://', 'Windows', 'windows', 'macOS']",
"message": "references multiple operating systems [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-650834d88ab7",
"source": "malcontent",
"ruleId": "r.21649a357848",
"severity": "info",
"confidence": 0.6,
"path": "src/openai/creds.rs",
"line": 0,
"snippet": "['base64_shell_encode::| base64']",
"message": "calls base64 command to encode strings [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-be6f222a6b48",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/openai/creds.rs",
"line": 80,
"snippet": "/// `https://api.openai.com/auth.chatgpt_plan_type`.",
"message": "URL literal: https://api.openai.com",
"category": "network",
"hardFail": false
},
{
"id": "F-d832236ecba3",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/openai/fetch.rs",
"line": 18,
"snippet": "pub const USAGE_URL: &str = \"https://chatgpt.com/backend-api/wham/usage\";",
"message": "URL literal: https://chatgpt.com",
"category": "network",
"hardFail": false
},
{
"id": "F-7a37082e4fd2",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/openai/fetch.rs",
"line": 262,
"snippet": "\"https://api.openai.com/auth\": {\"chatgpt_plan_type\": \"plus\"}",
"message": "URL literal: https://api.openai.com",
"category": "network",
"hardFail": false
},
{
"id": "F-52e464ee056a",
"source": "malcontent",
"ruleId": "r.ef1ffca5d1bd",
"severity": "info",
"confidence": 0.6,
"path": "src/openai/oauth.rs",
"line": 0,
"snippet": "['client_id']",
"message": "contains a client ID [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-79585209b836",
"source": "malcontent",
"ruleId": "r.8d917b297212",
"severity": "info",
"confidence": 0.6,
"path": "src/openai/oauth.rs",
"line": 0,
"snippet": "['application/json', 'POST', 'post']",
"message": "upload content via HTTP form [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-7f90282d221c",
"source": "malcontent",
"ruleId": "r.7f5b9be716d8",
"severity": "info",
"confidence": 0.6,
"path": "src/openai/oauth.rs",
"line": 0,
"snippet": "['Content-Type', 'POST', 'http']",
"message": "submits content to websites [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-4621f01e66d1",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/openai/oauth.rs",
"line": 1,
"snippet": "//! OAuth refresh — POST `https://auth.openai.com/oauth/token`.",
"message": "URL literal: https://auth.openai.com",
"category": "network",
"hardFail": false
},
{
"id": "F-b952226f2b9f",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/openai/types.rs",
"line": 1,
"snippet": "//! Wire types for `GET https://chatgpt.com/backend-api/wham/usage`.",
"message": "URL literal: https://chatgpt.com",
"category": "network",
"hardFail": false
},
{
"id": "F-e3518096a36e",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/openrouter/fetch.rs",
"line": 12,
"snippet": "pub const BASE_URL: &str = \"https://openrouter.ai/api/v1\";",
"message": "URL literal: https://openrouter.ai",
"category": "network",
"hardFail": false
},
{
"id": "F-02b09a97aa76",
"source": "malcontent",
"ruleId": "r.98f4a8002aa3",
"severity": "info",
"confidence": 0.6,
"path": "src/openrouter/vendor.rs",
"line": 0,
"snippet": "['spoof']",
"message": "references spoofing [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-7151fba09fd5",
"source": "malcontent",
"ruleId": "r.61ca01356bc1",
"severity": "low",
"confidence": 0.6,
"path": "src/safe_storage.rs",
"line": 0,
"snippet": "['find-generic-password']",
"message": "Looks up a password from the Keychain [HIGH]",
"category": "other",
"hardFail": false
},
{
"id": "F-6038145f0958",
"source": "malcontent",
"ruleId": "r.6f995e4f75aa",
"severity": "info",
"confidence": 0.6,
"path": "src/safe_storage.rs",
"line": 0,
"snippet": "['ciphertext']",
"message": "mentions 'ciphertext' [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-78ce901aa63b",
"source": "malcontent",
"ruleId": "r.76acf10b43f4",
"severity": "info",
"confidence": 0.6,
"path": "src/safe_storage.rs",
"line": 0,
"snippet": "['Encrypt plaintext back', 'BlockEncryptMut', 'Encryptor']",
"message": "encrypts data [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-0190c4223472",
"source": "malcontent",
"ruleId": "r.37f8ac39acb1",
"severity": "info",
"confidence": 0.6,
"path": "src/safe_storage.rs",
"line": 0,
"snippet": "['OpenSSL']",
"message": "Uses OpenSSL [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-55802f7460b0",
"source": "malcontent",
"ruleId": "r.1e699382d2a5",
"severity": "info",
"confidence": 0.6,
"path": "src/safe_storage.rs",
"line": 0,
"snippet": "['base64_content::\"djEwykc2I53A+doQo9OF96du2A==\"']",
"message": "Contains embedded base64 content [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-24c8c6dc6d3e",
"source": "malcontent",
"ruleId": "r.3e359da84e56",
"severity": "info",
"confidence": 0.6,
"path": "src/supergrok/acp.rs",
"line": 0,
"snippet": "['agent']",
"message": "references an 'agent' [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-aece7eded4c6",
"source": "malcontent",
"ruleId": "r.5dc13594e86f",
"severity": "low",
"confidence": 0.6,
"path": "src/supergrok/fetch.rs",
"line": 0,
"snippet": "['fallback_payload', 'fresh_payload', 'write_payload', 'payload_path', 'payload_age']",
"message": "payload path [HIGH]",
"category": "other",
"hardFail": false
},
{
"id": "F-a380368f99ae",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/supergrok/scope.rs",
"line": 220,
"snippet": "(name == \"GROK_OIDC_ISSUER\").then(|| OsString::from(\"https://idp-a.test\"))",
"message": "URL literal: https://idp-a.test",
"category": "network",
"hardFail": false
},
{
"id": "F-9b5f212a5f9d",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/supergrok/scope.rs",
"line": 224,
"snippet": "(name == \"GROK_OIDC_ISSUER\").then(|| OsString::from(\"https://idp-b.test\"))",
"message": "URL literal: https://idp-b.test",
"category": "network",
"hardFail": false
},
{
"id": "F-c554b9356d38",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "src/theme.rs",
"line": 5,
"snippet": "//! 2. Omarchy theme at `~/.config/omarchy/current/theme/colors.toml`",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-b661d5142340",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "src/theme.rs",
"line": 157,
"snippet": "Some(PathBuf::from(home).join(\".config/omarchy/current/theme/colors.toml\"))",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-de573fd69c98",
"source": "malcontent",
"ruleId": "r.61ca01356bc1",
"severity": "info",
"confidence": 0.6,
"path": "src/tui/app.rs",
"line": 0,
"snippet": "['Keychain']",
"message": "accesses a keychain [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-b0d55bfb3e6d",
"source": "malcontent",
"ruleId": "r.3e359da84e56",
"severity": "info",
"confidence": 0.6,
"path": "src/tui/app.rs",
"line": 0,
"snippet": "['agent_auth_path', 'default_agent']",
"message": "references an 'agent' [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-5dd1b6100cc8",
"source": "opengrep",
"ruleId": "r.5e2eff489ad3",
"severity": "info",
"confidence": 0.9,
"path": "src/tui/app.rs",
"line": 238,
"snippet": "/// (`$HOME/.config/omarchy/current/theme/colors.toml`) — `new` resolves",
"message": "Calls Omarchy commands or touches Omarchy shell state.",
"category": "other",
"hardFail": false
},
{
"id": "F-2058e5417774",
"source": "malcontent",
"ruleId": "r.bd0dc86cbeb5",
"severity": "info",
"confidence": 0.6,
"path": "src/tui/settings.rs",
"line": 0,
"snippet": "['chmod']",
"message": "modifies file permissions [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-c6e43d472722",
"source": "malcontent",
"ruleId": "r.f096078dc3a9",
"severity": "info",
"confidence": 0.6,
"path": "src/widget/cli.rs",
"line": 0,
"snippet": "['/tmp/acct-a/credentials.json']",
"message": "path reference within /tmp [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-a2e0533bb49e",
"source": "malcontent",
"ruleId": "r.28ce290c9d3f",
"severity": "info",
"confidence": 0.6,
"path": "src/widget/run.rs",
"line": 0,
"snippet": "['sqlite3']",
"message": "accesses SQLite databases [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-4777e5acf201",
"source": "malcontent",
"ruleId": "r.61ca01356bc1",
"severity": "info",
"confidence": 0.6,
"path": "src/widget/run.rs",
"line": 0,
"snippet": "['Keychain', 'keychain']",
"message": "accesses a keychain [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-6d61eee7af66",
"source": "malcontent",
"ruleId": "r.f096078dc3a9",
"severity": "info",
"confidence": 0.6,
"path": "src/widget/run.rs",
"line": 0,
"snippet": "['/tmp/cache/anthropic/work', '/tmp/creds.json']",
"message": "path reference within /tmp [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-bbe4fcf2b4d5",
"source": "malcontent",
"ruleId": "r.3e359da84e56",
"severity": "info",
"confidence": 0.6,
"path": "src/widget/run.rs",
"line": 0,
"snippet": "['agent_auth_path', 'default_agent']",
"message": "references an 'agent' [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-c915476926f4",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/zai/fetch.rs",
"line": 13,
"snippet": "pub const QUOTA_URL: &str = \"https://api.z.ai/api/monitor/usage/quota/limit\";",
"message": "URL literal: https://api.z.ai",
"category": "network",
"hardFail": false
},
{
"id": "F-25de4fe53deb",
"source": "textscan",
"ruleId": "r.4dc275665c39",
"severity": "info",
"confidence": 1.0,
"path": "src/zai/types.rs",
"line": 2,
"snippet": "//! `https://api.z.ai/api/monitor/usage/quota/limit`.",
"message": "URL literal: https://api.z.ai",
"category": "network",
"hardFail": false
},
{
"id": "F-f20d6cdfe8af",
"source": "malcontent",
"ruleId": "r.28ce290c9d3f",
"severity": "info",
"confidence": 0.6,
"path": "tests/live.rs",
"line": 0,
"snippet": "['sqlite3']",
"message": "accesses SQLite databases [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-8530968d5932",
"source": "malcontent",
"ruleId": "r.61ca01356bc1",
"severity": "info",
"confidence": 0.6,
"path": "tests/live.rs",
"line": 0,
"snippet": "['Keychain']",
"message": "accesses a keychain [MEDIUM]",
"category": "other",
"hardFail": false
},
{
"id": "F-6c71d3288285",
"source": "malcontent",
"ruleId": "r.3e359da84e56",
"severity": "info",
"confidence": 0.6,
"path": "tests/live.rs",
"line": 0,
"snippet": "['agent_auth_path', 'default_agent']",
"message": "references an 'agent' [MEDIUM]",
"category": "other",
"hardFail": false
}
],
"ai": {
"pass1": {
"status": "ok",
"output": {
"summary": "QML only runs fixed-argv external ai-usagebar CLI (usage, settings show/apply) and launches a TUI. No obfuscation or injection found. The Rust CLI wasn't reviewed in depth; it reads provider credentials by design.",
"whatItDoes": {
"oneLiner": "Bar widget that periodically runs the external ai-usagebar CLI for JSON usage and shows it in a panel, with settings that pipe API keys to the CLI."
},
"additionalFindings": [
{
"severity": "low",
"path": "omarchy/SettingsView.qml",
"line": 161,
"message": "Settings apply passes API keys to the external ai-usagebar CLI, which is not reviewed.",
"category": "secret",
"snippet": "command: [\"ai-usagebar\", \"settings\", \"apply\"]"
}
],
"escalate": false,
"escalateReason": "",
"injectionObserved": false,
"injectionNotes": "",
"canaryObserved": false
},
"turns": 4,
"costUsd": 0.1013772
},
"pass2": [
{
"findingId": "F-9df0e6be422e",
"verdict": "confirmed",
"reason": "Snippet runs external 'ai-usagebar' binary via Process; it is not part of the repository snippets shown."
},
{
"findingId": "F-24d84c301ed2",
"verdict": "unsure",
"reason": "Only the trigger block is shown; no cache or artifact steps visible to judge cache poisoning."
},
{
"findingId": "F-5e6df67d720c",
"verdict": "confirmed",
"reason": "`command -v ${cli}` interpolated into bash -lc; injection if cli is untrusted. Origin of cli not visible."
},
{
"findingId": "F-cc336e1bead4",
"verdict": "unsure",
"reason": "Process invokes 'ai-usagebar settings apply' with stdin enabled, but snippet does not show API keys being written."
},
{
"findingId": "F-c1b535e8d273",
"verdict": "likely-fp",
"reason": "Value is a fixed test-fixture assertion in a unit test (assert_eq), not a real secret."
}
],
"guard": {
"canaryOk": true,
"positiveControlOk": null,
"disallowedToolUse": false,
"schemaValid": true,
"failures": []
}
}
}
}
}