{"schemaVersion":1,"id":"omamail","name":"Omamail","repo":"https://github.com/huacnlee/omamail","listingState":"listed","marketplaceUrl":"https://plugins.omarchy.org/plugin.html?id=omamail","combined":{"verdict":"caution","basis":"trusted","contested":false,"commits":["3d0d673715cb0fb4f49cb718c2a2dbc002ee8763"],"reasons":["marketplace [unsigned]: caution","opc [core]: caution"],"tree":"c3802736d515a6e9e3d7bf83503322c3101d4e7b"},"providers":[{"provider":"marketplace","tier":"unsigned","verification":"unsigned","signer":null,"signedAt":null,"commit":"3d0d673715cb0fb4f49cb718c2a2dbc002ee8763","tree":null,"verdict":"caution","effectiveVerdict":"caution","adjustments":[],"counted":true,"timeReviewed":"2026-08-20T03:19:58Z","statement":null,"summary":"marketplace baseline: review-required","detail":{"outcome":"review-required","findings":[],"capabilities":["installer"],"enforcementMode":"selective"}},{"provider":"opc","tier":"core","verification":"sigstore","signer":"https://github.com/PrometheusRoot/omarchy-plugin-check-data/.github/workflows/sign.yml@refs/heads/master","signedAt":"2026-10-03T20:06:25Z","commit":"3d0d673715cb0fb4f49cb718c2a2dbc002ee8763","tree":"c3802736d515a6e9e3d7bf83503322c3101d4e7b","verdict":"caution","effectiveVerdict":"caution","adjustments":[],"counted":true,"timeReviewed":"2026-10-02T10:59:51Z","statement":"plugins/omamail/opc/3d0d673715cb0fb4f49cb718c2a2dbc002ee8763.json","summary":"caution: supply-chain, exec (4 finding(s) above info)","criteria":{"checked":["safe-to-run","no-network","no-exec","no-persistence","no-privilege","no-obfuscation","no-secrets"],"failed":["no-network","no-exec"],"notChecked":["reviewed-by-human"]},"findings":[{"category":"supply-chain","severity":"low","confidence":0.5,"message":"runtime artifacts potentially vulnerable to a cache poisoning attack (https://docs.zizmor.sh/audits/#cache-poisoning)","locations":[{"path":".github/workflows/release.yml","startLine":5}]},{"category":"supply-chain","severity":"low","confidence":0.9,"message":"unpinned action reference (https://docs.zizmor.sh/audits/#unpinned-uses)","locations":[{"path":".github/workflows/release.yml","startLine":17}]},{"category":"supply-chain","severity":"low","confidence":0.9,"message":"unpinned action reference (https://docs.zizmor.sh/audits/#unpinned-uses)","locations":[{"path":".github/workflows/release.yml","startLine":23}]},{"category":"exec","severity":"low","confidence":0.7,"message":"Shell command string built by concatenation inside `sh -c` — command injection if any part is untrusted (network data, file names, user input).","locations":[{"path":"AuthManager.qml","startLine":531,"endLine":532}]}],"detail":{"scope":{"kind":"full","path":""},"method":["static","ai"],"target":"marketplace-listing","report":{"schemaVersion":1,"plugin":{"id":"omamail","name":"Omamail","repo":"https://github.com/huacnlee/omamail","listingState":"listed","marketplace":{"verificationCommit":null,"listingValidatedCommit":"3d0d673715cb0fb4f49cb718c2a2dbc002ee8763","upstreamObservedCommit":"af8a7aef4f7522adc098fab738178f884d57eba5","baselineOutcome":"passed","verificationStatus":"unverified","caps":[],"stars":272,"catalogGeneratedAt":"2026-09-30T14:53:56.598Z","manifestPath":"manifest.json","repositoryLayout":"root-plugin","author":"huacnlee","description":"Email client for Omarchy: read, triage, and reply to Gmail, HEY and any JMAP or IMAP mailbox in a native window. Fastmail, iCloud, Outlook, Zoho, Proton Bridge, or your own server — several accounts at once, each with its own inbox and unread count. Keyboard-first, three columns when there is room and one when there is not, and it follows your theme. Meeting invitations are drawn as meetings you can answer, newsletters unsubscribe in one click, and remote images stay blocked until you ask.","category":"Productivity","kind":"Bar widget","tags":["quickshell","bar"],"license":"MIT","installCommand":"omarchy plugin add https://github.com/huacnlee/omamail.git --enable"}},"review":{"commit":"3d0d673715cb0fb4f49cb718c2a2dbc002ee8763","scanTarget":"marketplace-listing","pluginPath":"","reviewedAt":"2026-10-02T10:59:51Z","aiModel":"sonnet+fable","upstreamHeadAtScan":"2d5f2bd9890a3adee636a55df184108d0eda29b7","previousCommit":null,"tools":[{"name":"inventory","version":null,"status":"ok"},{"name":"textscan","version":null,"status":"ok"},{"name":"extcode","version":null,"status":"ok"},{"name":"heckler","version":"1.0.0","status":"ok"},{"name":"ctxsentry","version":"0.5.0","status":"ok"},{"name":"opengrep","version":"1.30.0","status":"ok"},{"name":"yara","version":"4.5.4","status":"ok"},{"name":"malcontent","version":"1.26.1","status":"ok"},{"name":"shellcheck","version":"0.11.0","status":"ok"},{"name":"bandit","version":"1.9.4","status":"ok"},{"name":"eslint","version":"10.11.0","status":"ok"},{"name":"qmllint","version":"6.4.2","status":"ok"},{"name":"gitleaks","version":"8.30.1","status":"ok"},{"name":"guarddog","version":null,"status":"skipped"},{"name":"osv","version":null,"status":"skipped"},{"name":"zizmor","version":"1.30.1","status":"ok"},{"name":"clamav","version":null,"status":"skipped"},{"name":"perf","version":null,"status":"ok"},{"name":"quality","version":null,"status":"ok"}],"rulesVersion":"r-05e7b1572de1","scannerVersion":"0.1.0"},"verdict":{"outcome":"caution","score":13,"hardFails":[],"aiEscalation":null,"summary":"caution: score 13; 4 low; uses processExec, network, fileWrite","reasons":["capabilities: processExec, network, fileWrite"],"criteria":{"checked":["safe-to-run","no-network","no-exec","no-persistence","no-privilege","no-obfuscation","no-secrets"],"failed":["no-network","no-exec"],"notChecked":["reviewed-by-human"]}},"whatItDoes":{"oneLiner":"Gmail client for Omarchy: bar unread count plus a mail window using Google OAuth and the Gmail API, with on-disk caches and helper scripts.","kinds":["service","bar-widget","panel"],"entryPoints":[{"key":"service","path":"Service.qml"},{"key":"barWidget","path":"BarWidget.qml"},{"key":"panel","path":"App.qml"}],"manifestValid":true,"manifestError":null},"capabilities":{"processExec":{"level":"med","evidence":["F-e5be7cddbb63","F-e90db538c5d6","F-4df641eedf3a","F-72ca7f767f0a","F-44203a4a63f4","F-397f73bde6fc","F-fc5a5294ee36","F-44263f2a9326","F-75cafc5ee6c5","F-c0111b9fcafb","F-71263fecd050","F-0e1f2abaca09","F-08ef8a6752c7","F-095a5ba342e8","F-29b2b754c89b","F-439009961b01","F-25fa7dc0421a","F-fc5318df6842","F-b4b40c07f81c","F-4111155de5b6","F-742de92cf9e4","F-bc979b4f681d","F-080e9ba39bcb","F-38de13c4397a","F-0ef17a79d1df","F-03b763f6ae9f"]},"network":{"level":"med","evidence":["F-6aac18c53873","F-5a003756e2ad"]},"fileWrite":{"level":"low","evidence":["F-14599a1236a0"]},"persistence":{"level":"none","evidence":[]},"privilege":{"level":"none","evidence":[]},"packageInstall":{"level":"none","evidence":[]},"bundledBinary":{"level":"none","evidence":[]},"clipboard":{"level":"none","evidence":[]},"screenCapture":{"level":"none","evidence":[]},"hyprlandIpc":{"level":"none","evidence":[]},"externalCode":{"level":"none","evidence":[],"externals":[]}},"systemAreas":{"touched":[],"evidence":[]},"network":{"hosts":[{"host":"127.0.0.1","schemes":["http"],"evidence":["F-9b0545594ca3","F-0320f074ffec"]},{"host":"accounts.google.com","schemes":["https"],"evidence":["F-af5ceb64a7a9","F-082d870b4cc1"]},{"host":"console.cloud.google.com","schemes":["https"],"evidence":["F-62be81e2cedf","F-3481d4246d28"]},{"host":"github.com","schemes":["https"],"evidence":["F-8939170611f2"]},{"host":"gmail.googleapis.com","schemes":["https"],"evidence":["F-efd8f465b29d"]},{"host":"localhost","schemes":["http"],"evidence":["F-f8c2c4999d4d"]},{"host":"mail.google.com","schemes":["https"],"evidence":["F-b6aa71e8bd2a"]},{"host":"oauth2.googleapis.com","schemes":["https"],"evidence":["F-6d5d012b680d","F-c0c791642a6a"]},{"host":"www.googleapis.com","schemes":["https"],"evidence":["F-2dd3e6fabbd0","F-330d50b23cdd"]},{"host":"x.com","schemes":["https"],"evidence":["F-496aa08b2f66"]}]},"dependencies":{"packages":[],"systemPackages":[],"vulnerabilities":[]},"secrets":{"count":1,"items":[{"findingId":"F-771d0c88d227","kind":"generic-api-key","live":null}]},"supplyChain":{"scorecard":null,"pinnedDeps":null,"signedCommitRatio":0.143,"busFactor":1,"repoAgeDays":44,"unpinnedRemoteFetches":[]},"injection":{"hiddenUnicode":{"count":0,"evidence":[]},"promptInjection":{"count":0,"evidence":[]},"obfuscation":{"count":0,"evidence":[]}},"codeQuality":{"loc":{"total":23362,"byLanguage":[{"language":"HTML","files":6,"lines":11569},{"language":"QML","files":31,"lines":6679},{"language":"JavaScript","files":17,"lines":4492},{"language":"Shell","files":10,"lines":421},{"language":"Python","files":2,"lines":92},{"language":"YAML","files":2,"lines":58},{"language":"Makefile","files":1,"lines":51}]},"lint":[{"tool":"shellcheck","errors":0,"warnings":0},{"tool":"eslint","errors":8,"warnings":7},{"tool":"qmllint","errors":0,"warnings":5437},{"tool":"bandit","errors":0,"warnings":0}],"tests":{"present":true,"files":14},"docs":{"readme":true,"changelog":false},"license":{"spdx":"MIT","file":true},"hotspots":[{"path":".github/workflows/release.yml","reason":"r.2349fafea766; r.738c1f331045"},{"path":"AuthManager.qml","reason":"r.01e0e842c851"}]},"performance":{"timers":[{"path":"App.qml","line":785,"intervalMs":6000,"repeat":false,"spawnsProcess":false},{"path":"AuthManager.qml","line":593,"intervalMs":120,"repeat":false,"spawnsProcess":false},{"path":"AuthManager.qml","line":599,"intervalMs":250,"repeat":false,"spawnsProcess":false},{"path":"AuthManager.qml","line":605,"intervalMs":180000,"repeat":false,"spawnsProcess":false},{"path":"CacheStore.qml","line":117,"intervalMs":800,"repeat":false,"spawnsProcess":false},{"path":"MailAccount.qml","line":828,"intervalMs":30000,"repeat":true,"spawnsProcess":false},{"path":"MailAccount.qml","line":835,"intervalMs":4000,"repeat":false,"spawnsProcess":false},{"path":"MailAccount.qml","line":843,"intervalMs":null,"repeat":true,"spawnsProcess":false}],"estSpawnsPerMin":0.0,"keepLoaded":true,"largeAssets":[],"polling":[]},"maintenance":{"lastCommitAt":"2026-08-20T02:38:55Z","commits90d":56,"contributors":1,"openIssues":null,"archived":null,"latestRelease":"v0.3.0"},"diffSinceLastReview":null,"findings":[{"id":"F-88144fd9077e","source":"zizmor","ruleId":"r.02ed6a656740","severity":"low","confidence":0.5,"path":".github/workflows/release.yml","line":5,"snippet":"on:   push:     tags:       - \"v*\"","message":"runtime artifacts potentially vulnerable to a cache poisoning attack (https://docs.zizmor.sh/audits/#cache-poisoning)","category":"supply-chain","hardFail":false},{"id":"F-6c9482d10820","source":"zizmor","ruleId":"r.f629672d34ab","severity":"info","confidence":0.5,"path":".github/workflows/release.yml","line":17,"snippet":"uses: actions/checkout@v4         with:           # Release notes are generated from the history since the last tag, so           # a shallow clone would produce an empty changelog.           fetch-depth: 0","message":"credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)","category":"supply-chain","hardFail":false},{"id":"F-ab1f745eae18","source":"zizmor","ruleId":"r.d5459638b76c","severity":"low","confidence":0.9,"path":".github/workflows/release.yml","line":17,"snippet":"uses: actions/checkout@v4         with:           # Release notes are generated from the history since the last tag, so           # a shallow clone would produce an empty changelog.           fetch-depth: 0","message":"unpinned action reference (https://docs.zizmor.sh/audits/#unpinned-uses)","category":"supply-chain","hardFail":false},{"id":"F-e1df16332aac","source":"zizmor","ruleId":"r.d5459638b76c","severity":"low","confidence":0.9,"path":".github/workflows/release.yml","line":23,"snippet":"uses: actions/setup-node@v4         with:           node-version: \"20\"        # The manifest version is what Omarchy installs and what the marketplace       # lists. A tag that disagrees with it would publish a release describing a       # version nobody can install, so it fails here instead.","message":"unpinned action reference (https://docs.zizmor.sh/audits/#unpinned-uses)","category":"supply-chain","hardFail":false},{"id":"F-41a750e86a83","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"AGENTS.md","line":92,"snippet":"the source regressions, `qmllint`, and `omarchy plugin validate`.","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-e59be67d8896","source":"malcontent","ruleId":"r.ef1ffca5d1bd","severity":"info","confidence":0.6,"path":"Accounts.js","line":0,"snippet":"['clientId']","message":"contains a client ID [MEDIUM]","category":"other","hardFail":false},{"id":"F-a4d2d6243960","source":"malcontent","ruleId":"r.811077312edb","severity":"info","confidence":0.6,"path":"App.qml","line":0,"snippet":"['| sh']","message":"pipes to shell [MEDIUM]","category":"other","hardFail":false},{"id":"F-8ee764824910","source":"malcontent","ruleId":"r.ef1ffca5d1bd","severity":"info","confidence":0.6,"path":"AuthManager.qml","line":0,"snippet":"['client_id', 'clientId']","message":"contains a client ID [MEDIUM]","category":"other","hardFail":false},{"id":"F-3d2e24cfe8c6","source":"malcontent","ruleId":"r.37f8ac39acb1","severity":"info","confidence":0.6,"path":"AuthManager.qml","line":0,"snippet":"['openssl']","message":"Uses OpenSSL [MEDIUM]","category":"other","hardFail":false},{"id":"F-aca3e41f4253","source":"malcontent","ruleId":"r.0a992cf3dce0","severity":"info","confidence":0.6,"path":"AuthManager.qml","line":0,"snippet":"['>/dev/null 2>&1']","message":"Runs shell commands but throws output away [MEDIUM]","category":"other","hardFail":false},{"id":"F-46ba01fc4581","source":"malcontent","ruleId":"r.8d917b297212","severity":"info","confidence":0.6,"path":"AuthManager.qml","line":0,"snippet":"['application/x-www-form-urlencoded', 'POST']","message":"upload content via HTTP form [MEDIUM]","category":"other","hardFail":false},{"id":"F-b6155f7c1edb","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"AuthManager.qml","line":0,"snippet":"['Content-Type', 'POST']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-c2d5a3609898","source":"malcontent","ruleId":"r.7fa443e83b73","severity":"info","confidence":0.6,"path":"AuthManager.qml","line":0,"snippet":"['urlencode']","message":"encodes URL, likely to pass GET variables [MEDIUM]","category":"other","hardFail":false},{"id":"F-6aac18c53873","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"AuthManager.qml","line":321,"snippet":"var request = new XMLHttpRequest()","message":"HTTP request from QML/JS (XMLHttpRequest / fetch).","category":"network","hardFail":false},{"id":"F-e5be7cddbb63","source":"opengrep","ruleId":"r.a386cbd0d0fa","severity":"info","confidence":0.9,"path":"AuthManager.qml","line":417,"snippet":"Quickshell.execDetached([\"xdg-open\", OAuth.authorizationUrl({","message":"Detached process launch (Quickshell.execDetached / startDetached).","category":"exec","hardFail":false},{"id":"F-e6cfc9561fcc","source":"ai","ruleId":"r.21fb3613b087","severity":"info","confidence":0.6,"path":"AuthManager.qml","line":531,"snippet":"toolProbe.command = [\"sh\", \"-c\",","message":"The sh -c string is built only from the internal requiredTools list, so it is likely not injectable. I did not check that list's source.","category":"exec","hardFail":false},{"id":"F-e90db538c5d6","source":"opengrep","ruleId":"r.145d7e49b5e9","severity":"info","confidence":0.9,"path":"AuthManager.qml","line":531,"snippet":"toolProbe.command = [\"sh\", \"-c\",","message":"Runs a shell command string via `sh -c`.","category":"exec","hardFail":false},{"id":"F-4df641eedf3a","source":"opengrep","ruleId":"r.01e0e842c851","severity":"low","confidence":0.7,"path":"AuthManager.qml","line":531,"snippet":"toolProbe.command = [\"sh\", \"-c\",       \"for tool in \" + requiredTools.join(\" \")","message":"Shell command string built by concatenation inside `sh -c` — command injection if any part is untrusted (network data, file names, user input).","category":"exec","hardFail":false,"endLine":532},{"id":"F-72ca7f767f0a","source":"opengrep","ruleId":"r.773ca74ce5dc","severity":"info","confidence":0.9,"path":"AuthManager.qml","line":553,"snippet":"Process {","message":"Quickshell Process — spawns external programs.","category":"exec","hardFail":false},{"id":"F-44203a4a63f4","source":"opengrep","ruleId":"r.773ca74ce5dc","severity":"info","confidence":0.9,"path":"AuthManager.qml","line":570,"snippet":"Process {","message":"Quickshell Process — spawns external programs.","category":"exec","hardFail":false},{"id":"F-397f73bde6fc","source":"opengrep","ruleId":"r.773ca74ce5dc","severity":"info","confidence":0.9,"path":"AuthManager.qml","line":611,"snippet":"Process {","message":"Quickshell Process — spawns external programs.","category":"exec","hardFail":false},{"id":"F-fc5a5294ee36","source":"opengrep","ruleId":"r.773ca74ce5dc","severity":"info","confidence":0.9,"path":"AuthManager.qml","line":623,"snippet":"Process {","message":"Quickshell Process — spawns external programs.","category":"exec","hardFail":false},{"id":"F-44263f2a9326","source":"opengrep","ruleId":"r.773ca74ce5dc","severity":"info","confidence":0.9,"path":"AuthManager.qml","line":643,"snippet":"Process {","message":"Quickshell Process — spawns external programs.","category":"exec","hardFail":false},{"id":"F-75cafc5ee6c5","source":"opengrep","ruleId":"r.773ca74ce5dc","severity":"info","confidence":0.9,"path":"AuthManager.qml","line":655,"snippet":"Process {","message":"Quickshell Process — spawns external programs.","category":"exec","hardFail":false},{"id":"F-c0111b9fcafb","source":"opengrep","ruleId":"r.773ca74ce5dc","severity":"info","confidence":0.9,"path":"AuthManager.qml","line":680,"snippet":"Process {","message":"Quickshell Process — spawns external programs.","category":"exec","hardFail":false},{"id":"F-71263fecd050","source":"opengrep","ruleId":"r.a386cbd0d0fa","severity":"info","confidence":0.9,"path":"BodyCache.qml","line":67,"snippet":"Quickshell.execDetached([script, \"touch\", directory, name])","message":"Detached process launch (Quickshell.execDetached / startDetached).","category":"exec","hardFail":false},{"id":"F-0e1f2abaca09","source":"opengrep","ruleId":"r.a386cbd0d0fa","severity":"info","confidence":0.9,"path":"BodyCache.qml","line":108,"snippet":"Quickshell.execDetached([script, \"clear\", directory])","message":"Detached process launch (Quickshell.execDetached / startDetached).","category":"exec","hardFail":false},{"id":"F-08ef8a6752c7","source":"opengrep","ruleId":"r.773ca74ce5dc","severity":"info","confidence":0.9,"path":"BodyCache.qml","line":111,"snippet":"Process {","message":"Quickshell Process — spawns external programs.","category":"exec","hardFail":false},{"id":"F-6dbbaa03fecb","source":"malcontent","ruleId":"r.bd0dc86cbeb5","severity":"info","confidence":0.6,"path":"CacheStore.qml","line":0,"snippet":"['chmod']","message":"modifies file permissions [MEDIUM]","category":"other","hardFail":false},{"id":"F-095a5ba342e8","source":"opengrep","ruleId":"r.773ca74ce5dc","severity":"info","confidence":0.9,"path":"CacheStore.qml","line":90,"snippet":"Process {","message":"Quickshell Process — spawns external programs.","category":"exec","hardFail":false},{"id":"F-29b2b754c89b","source":"opengrep","ruleId":"r.145d7e49b5e9","severity":"info","confidence":0.9,"path":"CacheStore.qml","line":94,"snippet":"command: [\"sh\", \"-c\", \"umask 077; mkdir -p \\\"$1\\\" && chmod 700 \\\"$1\\\"\", \"sh\", root.directory]","message":"Runs a shell command string via `sh -c`.","category":"exec","hardFail":false},{"id":"F-14599a1236a0","source":"opengrep","ruleId":"r.3ddf8e79d32d","severity":"info","confidence":0.9,"path":"CacheStore.qml","line":122,"snippet":"file.setText(Cache.serialize(root.store))","message":"Writes files from QML (FileView.setText / JsonAdapter writeAdapter).","category":"filesystem","hardFail":false},{"id":"F-e1f4bfe3237e","source":"malcontent","ruleId":"r.ef1ffca5d1bd","severity":"info","confidence":0.6,"path":"Credentials.js","line":0,"snippet":"['client_id', 'clientId']","message":"contains a client ID [MEDIUM]","category":"other","hardFail":false},{"id":"F-41792078caed","source":"malcontent","ruleId":"r.caf0fa6d38c2","severity":"info","confidence":0.6,"path":"Credentials.js","line":0,"snippet":"['Accepts the downloaded JSON']","message":"download files [MEDIUM]","category":"other","hardFail":false},{"id":"F-d5b167ac0501","source":"malcontent","ruleId":"r.cf062f27083e","severity":"info","confidence":0.6,"path":"Credentials.js","line":0,"snippet":"['accounts.google.com/o/oauth2/auth', 'googleapis.com/oauth2/v1/certs']","message":"exchanges credentials with Google [MEDIUM]","category":"other","hardFail":false},{"id":"F-af5ceb64a7a9","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Credentials.js","line":227,"snippet":"auth_uri: \"https://accounts.google.com/o/oauth2/auth\",","message":"URL literal: https://accounts.google.com","category":"network","hardFail":false},{"id":"F-6d5d012b680d","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Credentials.js","line":228,"snippet":"token_uri: \"https://oauth2.googleapis.com/token\",","message":"URL literal: https://oauth2.googleapis.com","category":"network","hardFail":false},{"id":"F-2dd3e6fabbd0","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Credentials.js","line":229,"snippet":"auth_provider_x509_cert_url: \"https://www.googleapis.com/oauth2/v1/certs\",","message":"URL literal: https://www.googleapis.com","category":"network","hardFail":false},{"id":"F-f8c2c4999d4d","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Credentials.js","line":231,"snippet":"redirect_uris: [\"http://localhost\"]","message":"URL literal: http://localhost","category":"network","hardFail":false},{"id":"F-efd8f465b29d","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"GmailApi.js","line":8,"snippet":"var API_BASE = \"https://gmail.googleapis.com/gmail/v1\"","message":"URL literal: https://gmail.googleapis.com","category":"network","hardFail":false},{"id":"F-b6aa71e8bd2a","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"GmailApi.js","line":9,"snippet":"var WEB_BASE = \"https://mail.google.com/mail/u\"","message":"URL literal: https://mail.google.com","category":"network","hardFail":false},{"id":"F-55eb3968905f","source":"malcontent","ruleId":"r.8d917b297212","severity":"info","confidence":0.6,"path":"GmailApiClient.qml","line":0,"snippet":"['application/json', 'POST']","message":"upload content via HTTP form [MEDIUM]","category":"other","hardFail":false},{"id":"F-28a52ec804d5","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"GmailApiClient.qml","line":0,"snippet":"['Content-Type', 'POST']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-5a003756e2ad","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"GmailApiClient.qml","line":68,"snippet":"var xhr = new XMLHttpRequest()","message":"HTTP request from QML/JS (XMLHttpRequest / fetch).","category":"network","hardFail":false},{"id":"F-4adaf4d77c23","source":"malcontent","ruleId":"r.fb014819c620","severity":"info","confidence":0.6,"path":"Html.js","line":0,"snippet":"['fromCharCode', '[0-9a-fA-F]', '[a-z0-9-]', '(at + 1)', '[a-z0-9]', '[a-zA-Z]', 'parseInt', '[0-9]', '[a-z]']","message":"complex math with parseInt or fromCharCode conversions [MEDIUM]","category":"other","hardFail":false},{"id":"F-b3f8d18b691d","source":"malcontent","ruleId":"r.49d5f573ce86","severity":"info","confidence":0.6,"path":"Html.js","line":0,"snippet":"['<img src>', '<html>']","message":"Contains HTML content [MEDIUM]","category":"other","hardFail":false},{"id":"F-7815132d54e8","source":"malcontent","ruleId":"r.c8f2cb7996f8","severity":"info","confidence":0.6,"path":"Html.js","line":0,"snippet":"['String.fromCharCode(code']","message":"assembles strings from UTF-16 code units [MEDIUM]","category":"other","hardFail":false},{"id":"F-c0afb1466e02","source":"malcontent","ruleId":"r.c6ece59a0429","severity":"info","confidence":0.6,"path":"Html.js","line":0,"snippet":"['listening on']","message":"generic listen string [MEDIUM]","category":"other","hardFail":false},{"id":"F-9b0545594ca3","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Html.js","line":174,"snippet":"//   <img alt=\"a>b\" src=\"http://127.0.0.1/p.gif\">","message":"URL literal: http://127.0.0.1","category":"network","hardFail":false},{"id":"F-439009961b01","source":"opengrep","ruleId":"r.a386cbd0d0fa","severity":"info","confidence":0.9,"path":"MailAccount.qml","line":674,"snippet":"Quickshell.execDetached([\"notify-send\", \"-a\", \"Omamail\", \"-i\", \"mail-unread\",","message":"Detached process launch (Quickshell.execDetached / startDetached).","category":"exec","hardFail":false},{"id":"F-25fa7dc0421a","source":"opengrep","ruleId":"r.a386cbd0d0fa","severity":"info","confidence":0.9,"path":"MailAccount.qml","line":681,"snippet":"Quickshell.execDetached([\"notify-send\", \"-a\", \"Omamail\", \"-i\", \"mail-unread\",","message":"Detached process launch (Quickshell.execDetached / startDetached).","category":"exec","hardFail":false},{"id":"F-fc5318df6842","source":"opengrep","ruleId":"r.a386cbd0d0fa","severity":"info","confidence":0.9,"path":"MailAccount.qml","line":708,"snippet":"Quickshell.execDetached([\"xdg-open\", Api.webMessageUrl(id, 0)])","message":"Detached process launch (Quickshell.execDetached / startDetached).","category":"exec","hardFail":false},{"id":"F-b4b40c07f81c","source":"opengrep","ruleId":"r.a386cbd0d0fa","severity":"info","confidence":0.9,"path":"MailAccount.qml","line":712,"snippet":"Quickshell.execDetached([\"xdg-open\", Api.webSearchUrl(effectiveQuery, 0)])","message":"Detached process launch (Quickshell.execDetached / startDetached).","category":"exec","hardFail":false},{"id":"F-4111155de5b6","source":"opengrep","ruleId":"r.a386cbd0d0fa","severity":"info","confidence":0.9,"path":"MailAccount.qml","line":716,"snippet":"Quickshell.execDetached([\"xdg-open\", \"https://console.cloud.google.com/auth/clients/create\"])","message":"Detached process launch (Quickshell.execDetached / startDetached).","category":"exec","hardFail":false},{"id":"F-62be81e2cedf","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"MailAccount.qml","line":716,"snippet":"Quickshell.execDetached([\"xdg-open\", \"https://console.cloud.google.com/auth/clients/create\"])","message":"URL literal: https://console.cloud.google.com","category":"network","hardFail":false},{"id":"F-742de92cf9e4","source":"opengrep","ruleId":"r.a386cbd0d0fa","severity":"info","confidence":0.9,"path":"MailAccount.qml","line":720,"snippet":"Quickshell.execDetached([\"xdg-open\", \"https://console.cloud.google.com/auth/overview\"])","message":"Detached process launch (Quickshell.execDetached / startDetached).","category":"exec","hardFail":false},{"id":"F-bc979b4f681d","source":"opengrep","ruleId":"r.a386cbd0d0fa","severity":"info","confidence":0.9,"path":"MailAccount.qml","line":724,"snippet":"Quickshell.execDetached([\"xdg-open\",","message":"Detached process launch (Quickshell.execDetached / startDetached).","category":"exec","hardFail":false},{"id":"F-1904d8f02af2","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"Makefile","line":53,"snippet":"$(QMLLINT) -I /usr/share/omarchy/shell $(QML_FILES)","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-8e7c620b4f62","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"Makefile","line":56,"snippet":"omarchy plugin validate .","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-f9f0dede3957","source":"malcontent","ruleId":"r.fb014819c620","severity":"info","confidence":0.6,"path":"Message.js","line":0,"snippet":"['(elapsed / 86400000)', '(elapsed / 60000)', '(code - 0xd800)', '(low - 0xdc00)', '(value / 1024)', '(1024 * 1024)', 'fromCharCode', '64-characte', '[0-9A-Fa-f]', '[0-9a-fA-F]', 'windows-125', 'iso-8","message":"complex math with parseInt or fromCharCode conversions [MEDIUM]","category":"other","hardFail":false},{"id":"F-65dc911d5d45","source":"malcontent","ruleId":"r.d8aab1b9f2ec","severity":"info","confidence":0.6,"path":"Message.js","line":0,"snippet":"['js_base64_decode::atob(']","message":"decode base64 strings [MEDIUM]","category":"other","hardFail":false},{"id":"F-daca230194dd","source":"malcontent","ruleId":"r.c8f2cb7996f8","severity":"info","confidence":0.6,"path":"Message.js","line":0,"snippet":"['String.fromCharCode(Number(', 'String.fromCharCode(bytes[i', 'String.fromCharCode(codePoi', 'String.fromCharCode(parseIn', 'String.fromCharCode(0xd800', 'String.fromCharCode(byte1']","message":"assembles strings from UTF-16 code units [MEDIUM]","category":"other","hardFail":false},{"id":"F-76efde3b52bc","source":"malcontent","ruleId":"r.b4411f4acf66","severity":"info","confidence":0.6,"path":"Model.js","line":0,"snippet":"['unarchive']","message":"unarchives files [MEDIUM]","category":"other","hardFail":false},{"id":"F-a15c4fc8e557","source":"malcontent","ruleId":"r.dfefb009e79e","severity":"info","confidence":0.6,"path":"Model.js","line":0,"snippet":"['daemon']","message":"Run as a background daemon [MEDIUM]","category":"other","hardFail":false},{"id":"F-2b8776ca846d","source":"malcontent","ruleId":"r.ef1ffca5d1bd","severity":"info","confidence":0.6,"path":"OAuth.js","line":0,"snippet":"['client_id', 'clientId']","message":"contains a client ID [MEDIUM]","category":"other","hardFail":false},{"id":"F-a76efeccf646","source":"malcontent","ruleId":"r.49d5f573ce86","severity":"info","confidence":0.6,"path":"OAuth.js","line":0,"snippet":"['<html>']","message":"Contains HTML content [MEDIUM]","category":"other","hardFail":false},{"id":"F-f6db656d8727","source":"malcontent","ruleId":"r.813dbc864f85","severity":"info","confidence":0.6,"path":"OAuth.js","line":0,"snippet":"['decodeURIComponent']","message":"decodes URL components [MEDIUM]","category":"other","hardFail":false},{"id":"F-082d870b4cc1","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"OAuth.js","line":14,"snippet":"var AUTH_URL = \"https://accounts.google.com/o/oauth2/v2/auth\"","message":"URL literal: https://accounts.google.com","category":"network","hardFail":false},{"id":"F-c0c791642a6a","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"OAuth.js","line":15,"snippet":"var TOKEN_URL = \"https://oauth2.googleapis.com/token\"","message":"URL literal: https://oauth2.googleapis.com","category":"network","hardFail":false},{"id":"F-330d50b23cdd","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"OAuth.js","line":25,"snippet":"\"https://www.googleapis.com/auth/gmail.modify\",","message":"URL literal: https://www.googleapis.com","category":"network","hardFail":false},{"id":"F-0320f074ffec","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"OAuth.js","line":35,"snippet":"return \"http://127.0.0.1:\" + normalizedPort(port) + CALLBACK_PATH","message":"URL literal: http://127.0.0.1","category":"network","hardFail":false},{"id":"F-7fe3ce5b307c","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"README.md","line":6,"snippet":"official Gmail API. It runs inside the `omarchy-shell` process you already","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-5d662b098cba","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"README.md","line":32,"snippet":"omarchy plugin add https://github.com/huacnlee/omamail.git --enable","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-34234e77f838","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"README.md","line":39,"snippet":"o.bind(\"SUPER + SHIFT + G\", \"Omamail\", \"omarchy shell shell toggle omamail '{}'\")","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-3e88e2ea6a13","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"README.md","line":52,"snippet":"omarchy plugin remove omamail","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-ae48ecf3a0a2","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"README.md","line":167,"snippet":"./install.sh          # symlink this checkout into ~/.config/omarchy/plugins","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-a77f2548853c","source":"opengrep","ruleId":"r.123f30755310","severity":"info","confidence":0.9,"path":"README.md","line":167,"snippet":"./install.sh          # symlink this checkout into ~/.config/omarchy/plugins","message":"Writes Omarchy configuration/state.","category":"filesystem","hardFail":false},{"id":"F-dc4ceaf7d593","source":"malcontent","ruleId":"r.ef1ffca5d1bd","severity":"info","confidence":0.6,"path":"Service.qml","line":0,"snippet":"['clientId']","message":"contains a client ID [MEDIUM]","category":"other","hardFail":false},{"id":"F-080e9ba39bcb","source":"opengrep","ruleId":"r.a386cbd0d0fa","severity":"info","confidence":0.9,"path":"Service.qml","line":377,"snippet":"Quickshell.execDetached([\"xdg-open\", \"https://github.com/huacnlee/omamail\"])","message":"Detached process launch (Quickshell.execDetached / startDetached).","category":"exec","hardFail":false},{"id":"F-8939170611f2","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Service.qml","line":377,"snippet":"Quickshell.execDetached([\"xdg-open\", \"https://github.com/huacnlee/omamail\"])","message":"URL literal: https://github.com","category":"network","hardFail":false},{"id":"F-38de13c4397a","source":"opengrep","ruleId":"r.a386cbd0d0fa","severity":"info","confidence":0.9,"path":"Service.qml","line":381,"snippet":"Quickshell.execDetached([\"xdg-open\", \"https://x.com/huacnlee\"])","message":"Detached process launch (Quickshell.execDetached / startDetached).","category":"exec","hardFail":false},{"id":"F-496aa08b2f66","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Service.qml","line":381,"snippet":"Quickshell.execDetached([\"xdg-open\", \"https://x.com/huacnlee\"])","message":"URL literal: https://x.com","category":"network","hardFail":false},{"id":"F-0ef17a79d1df","source":"opengrep","ruleId":"r.773ca74ce5dc","severity":"info","confidence":0.9,"path":"Service.qml","line":436,"snippet":"Process {","message":"Quickshell Process — spawns external programs.","category":"exec","hardFail":false},{"id":"F-03b763f6ae9f","source":"opengrep","ruleId":"r.773ca74ce5dc","severity":"info","confidence":0.9,"path":"Service.qml","line":462,"snippet":"Process {","message":"Quickshell Process — spawns external programs.","category":"exec","hardFail":false},{"id":"F-d84a0f1b48f3","source":"malcontent","ruleId":"r.caf0fa6d38c2","severity":"info","confidence":0.6,"path":"components/ActionIcon.qml","line":0,"snippet":"['the universal download icon']","message":"download files [MEDIUM]","category":"other","hardFail":false},{"id":"F-fefe34459f76","source":"malcontent","ruleId":"r.c6ece59a0429","severity":"info","confidence":0.6,"path":"components/MessageReader.qml","line":0,"snippet":"['listening on']","message":"generic listen string [MEDIUM]","category":"other","hardFail":false},{"id":"F-7bcdc86281da","source":"malcontent","ruleId":"r.4466daea12b8","severity":"info","confidence":0.6,"path":"components/MessageReader.qml","line":0,"snippet":"['openUrl']","message":"requests resources via URL [MEDIUM]","category":"other","hardFail":false},{"id":"F-bbf287900f92","source":"malcontent","ruleId":"r.ef1ffca5d1bd","severity":"info","confidence":0.6,"path":"components/SetupPage.qml","line":0,"snippet":"['clientId']","message":"contains a client ID [MEDIUM]","category":"other","hardFail":false},{"id":"F-83e6d418b3e6","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/SPEC.md","line":5,"snippet":"logic, running inside the existing `omarchy-shell` process.","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-c619019e14cf","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":7,"snippet":"**Architecture:** A Quickshell plugin with three entry points inside the already-running `omarchy-shell` process: a headless `service` singleton owning auth and mailbox state, a `bar-widget` showing the unread badge, and a `panel` that is a real `FloatingWindow` application. Every parsing, formatting, and decision rule lives in `.pragma library` JavaScript so it runs under node in tests; QML stays","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-25911f715ac8","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":24,"snippet":"- `make validate` must pass before any task is considered done. It runs the node tests, the source regression tests, `qmllint`, and `omarchy plugin validate .`.","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-4f5735188fee","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":490,"snippet":"$(QMLLINT) -I /usr/share/omarchy/shell $(QML_FILES)","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-84183734d3d9","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":493,"snippet":"omarchy plugin validate .","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-dd4df31f545d","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":536,"snippet":"omarchy plugin validate \"$project_dir\"","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-0b6e6d5c7216","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":553,"snippet":"omarchy restart shell","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-bc8ae9e4814b","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":557,"snippet":"omarchy-shell shell rescanPlugins","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-61cce29782f9","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":558,"snippet":"omarchy plugin enable \"$plugin_id\"","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-adf7df978599","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":929,"snippet":"Run: `/usr/lib/qt6/bin/qmllint -I /usr/share/omarchy/shell BarWidget.qml components/GmailIcon.qml`","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-ee909b798682","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":1569,"snippet":"Run: `/usr/lib/qt6/bin/qmllint -I /usr/share/omarchy/shell components/MailboxSidebar.qml`","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-6566b949d001","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":1780,"snippet":"Run: `/usr/lib/qt6/bin/qmllint -I /usr/share/omarchy/shell components/SearchBar.qml components/AppMenu.qml`","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-9a22d46db290","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":2102,"snippet":"Run: `/usr/lib/qt6/bin/qmllint -I /usr/share/omarchy/shell components/MessageReader.qml`","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-89186243b6af","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":2403,"snippet":"Run: `/usr/lib/qt6/bin/qmllint -I /usr/share/omarchy/shell components/ComposeView.qml`","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-a19e843d846c","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":2699,"snippet":"Run: `/usr/lib/qt6/bin/qmllint -I /usr/share/omarchy/shell components/SetupPage.qml`","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-43e7b2e372d3","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":2864,"snippet":"Cover, in this order: what it is and why it is not a browser tab; the two-minute Google Cloud setup with the exact click path; installation via `omarchy plugin add`; the keyboard table; what it does not do (no embedded browser, one account, no attachment download yet); where secrets live; and the licence.","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-40e54f04a8cf","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":2869,"snippet":"Expected: every node test prints `ok`, the shell and python tests print `ok`, `qmllint` is silent, `omarchy plugin validate .` reports the manifest is valid, and `git diff --check` finds no whitespace errors.","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-b0706ba1835a","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"docs/superpowers/plans/2026-08-19-omarchy-gmail.md","line":2909,"snippet":"- Restarting the shell (`omarchy restart shell`) leaves the mailbox signed in","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-ecac7bbf194f","source":"malcontent","ruleId":"r.37f8ac39acb1","severity":"info","confidence":0.6,"path":"install.sh","line":0,"snippet":"['openssl']","message":"Uses OpenSSL [MEDIUM]","category":"other","hardFail":false},{"id":"F-f5ed4e5f2a1a","source":"malcontent","ruleId":"r.0a992cf3dce0","severity":"info","confidence":0.6,"path":"install.sh","line":0,"snippet":"['command -v omarchy >/dev/null 2>&1']","message":"Runs shell commands but throws output away [MEDIUM]","category":"other","hardFail":false},{"id":"F-431f45eaf790","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"install.sh","line":44,"snippet":"omarchy plugin validate \"$project_dir\"","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-a7b173eb1c5e","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"install.sh","line":67,"snippet":"omarchy restart shell","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-c3985ede8ae5","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"install.sh","line":71,"snippet":"omarchy-shell shell rescanPlugins","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-03ac785a3dd1","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"install.sh","line":72,"snippet":"omarchy plugin enable \"$plugin_id\"","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-02f2bb92cedb","source":"malcontent","ruleId":"r.1efae2d4d298","severity":"info","confidence":0.6,"path":"scripts/body-cache.sh","line":0,"snippet":"['/bin/sh']","message":"executes shell [MEDIUM]","category":"other","hardFail":false},{"id":"F-06cef7a032aa","source":"malcontent","ruleId":"r.b422e837e9e7","severity":"info","confidence":0.6,"path":"scripts/body-cache.sh","line":0,"snippet":"['rm -rf']","message":"Forcibly deletes files recursively [MEDIUM]","category":"other","hardFail":false},{"id":"F-d30ccb9a4948","source":"malcontent","ruleId":"r.31870d7ec837","severity":"info","confidence":0.6,"path":"scripts/body-cache.sh","line":0,"snippet":"['touch -m']","message":"change file timestamps [MEDIUM]","category":"other","hardFail":false},{"id":"F-38a7630d7417","source":"malcontent","ruleId":"r.bd0dc86cbeb5","severity":"info","confidence":0.6,"path":"scripts/body-cache.sh","line":0,"snippet":"['chmod']","message":"modifies file permissions [MEDIUM]","category":"other","hardFail":false},{"id":"F-c315a93ce160","source":"malcontent","ruleId":"r.1efae2d4d298","severity":"info","confidence":0.6,"path":"scripts/config-store.sh","line":0,"snippet":"['/bin/sh']","message":"executes shell [MEDIUM]","category":"other","hardFail":false},{"id":"F-1a93e43f9b72","source":"malcontent","ruleId":"r.bd0dc86cbeb5","severity":"info","confidence":0.6,"path":"scripts/config-store.sh","line":0,"snippet":"['chmod']","message":"modifies file permissions [MEDIUM]","category":"other","hardFail":false},{"id":"F-9f4fc045007c","source":"malcontent","ruleId":"r.0a992cf3dce0","severity":"info","confidence":0.6,"path":"scripts/google-cloud-setup.sh","line":0,"snippet":"['command -v xdg-open >/dev/null 2>&1', 'command -v gcloud >/dev/null 2>&1']","message":"Runs shell commands but throws output away [MEDIUM]","category":"other","hardFail":false},{"id":"F-970bdb9df6ee","source":"malcontent","ruleId":"r.79a39313280e","severity":"info","confidence":0.6,"path":"scripts/google-cloud-setup.sh","line":0,"snippet":"['/dev/urandom', '/dev/null']","message":"path reference within /dev [MEDIUM]","category":"other","hardFail":false},{"id":"F-3481d4246d28","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"scripts/google-cloud-setup.sh","line":65,"snippet":"consent_url=\"https://console.cloud.google.com/auth/overview?project=$project_id\"","message":"URL literal: https://console.cloud.google.com","category":"network","hardFail":false},{"id":"F-dbebee9ac260","source":"malcontent","ruleId":"r.1efae2d4d298","severity":"info","confidence":0.6,"path":"scripts/keyring-store.sh","line":0,"snippet":"['/bin/sh']","message":"executes shell [MEDIUM]","category":"other","hardFail":false},{"id":"F-e32fc5074648","source":"malcontent","ruleId":"r.1efae2d4d298","severity":"info","confidence":0.6,"path":"scripts/migrate-storage.sh","line":0,"snippet":"['/bin/sh']","message":"executes shell [MEDIUM]","category":"other","hardFail":false},{"id":"F-718bac69f4d5","source":"malcontent","ruleId":"r.37f8ac39acb1","severity":"info","confidence":0.6,"path":"scripts/pkce.sh","line":0,"snippet":"['openssl']","message":"Uses OpenSSL [MEDIUM]","category":"other","hardFail":false},{"id":"F-06c80af4ba2c","source":"malcontent","ruleId":"r.1efae2d4d298","severity":"info","confidence":0.6,"path":"scripts/pkce.sh","line":0,"snippet":"['/bin/sh']","message":"executes shell [MEDIUM]","category":"other","hardFail":false},{"id":"F-8a95855ff255","source":"eslint","ruleId":"r.91ce6a8cb27c","severity":"info","confidence":0.6,"path":"tests/load.js","line":12,"snippet":"","message":"Found readFileSync from package \"fs\" with non literal argument at index 0","category":"exec","hardFail":false},{"id":"F-ce9e14b8deaf","source":"malcontent","ruleId":"r.ef1ffca5d1bd","severity":"info","confidence":0.6,"path":"tests/test_accounts.js","line":0,"snippet":"['clientId']","message":"contains a client ID [MEDIUM]","category":"other","hardFail":false},{"id":"F-adb38082bc37","source":"malcontent","ruleId":"r.e764edde6b0e","severity":"info","confidence":0.6,"path":"tests/test_accounts.js","line":0,"snippet":"['./load']","message":"references and possibly executes relative path [MEDIUM]","category":"other","hardFail":false},{"id":"F-117efc12ab76","source":"malcontent","ruleId":"r.0b0a2ab1d6bb","severity":"info","confidence":0.6,"path":"tests/test_cache.js","line":0,"snippet":"['/etc/passwd']","message":"Detects access to sensitive files (credentials, configs, keys) [MEDIUM]","category":"other","hardFail":false},{"id":"F-eec353247d01","source":"malcontent","ruleId":"r.8a2d19128690","severity":"info","confidence":0.6,"path":"tests/test_cache.js","line":0,"snippet":"['/home/u/.cache']","message":"possible hidden file path [MEDIUM]","category":"other","hardFail":false},{"id":"F-96229d103eb1","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"tests/test_cache.js","line":190,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-0a4fe11305ff","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"tests/test_cache.js","line":191,"snippet":"","message":"Function Call Object Injection Sink","category":"exec","hardFail":false},{"id":"F-a275de079f1e","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"tests/test_cache.js","line":192,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-5c4e82c730d4","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"tests/test_cache.js","line":227,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-dd7b330a34b1","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"tests/test_cache.js","line":228,"snippet":"","message":"Function Call Object Injection Sink","category":"exec","hardFail":false},{"id":"F-6355de0382e2","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"tests/test_cache.js","line":229,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-2b167a5915c1","source":"malcontent","ruleId":"r.ef1ffca5d1bd","severity":"info","confidence":0.6,"path":"tests/test_credentials.js","line":0,"snippet":"['client_id', 'clientId']","message":"contains a client ID [MEDIUM]","category":"other","hardFail":false},{"id":"F-1d8bfc42ff98","source":"malcontent","ruleId":"r.8a2d19128690","severity":"info","confidence":0.6,"path":"tests/test_credentials.js","line":0,"snippet":"['/home/jason/.config']","message":"possible hidden file path [MEDIUM]","category":"other","hardFail":false},{"id":"F-aa302d21f0ac","source":"malcontent","ruleId":"r.e764edde6b0e","severity":"info","confidence":0.6,"path":"tests/test_credentials.js","line":0,"snippet":"['./load']","message":"references and possibly executes relative path [MEDIUM]","category":"other","hardFail":false},{"id":"F-d9a000b03feb","source":"malcontent","ruleId":"r.caf0fa6d38c2","severity":"info","confidence":0.6,"path":"tests/test_credentials.js","line":0,"snippet":"['----------- the downloaded JSON file', 'const downloaded']","message":"download files [MEDIUM]","category":"other","hardFail":false},{"id":"F-6009aa7958d2","source":"malcontent","ruleId":"r.cf062f27083e","severity":"info","confidence":0.6,"path":"tests/test_credentials.js","line":0,"snippet":"['accounts.google.com/o/oauth2/auth']","message":"exchanges credentials with Google [MEDIUM]","category":"other","hardFail":false},{"id":"F-9e1c03f52f66","source":"malcontent","ruleId":"r.e764edde6b0e","severity":"info","confidence":0.6,"path":"tests/test_gmail_api.js","line":0,"snippet":"['./load']","message":"references and possibly executes relative path [MEDIUM]","category":"other","hardFail":false},{"id":"F-d8360b04cec7","source":"malcontent","ruleId":"r.76ee5aa3c1ec","severity":"info","confidence":0.6,"path":"tests/test_html.js","line":0,"snippet":"['https://93.184.216.34']","message":"Detects URLs to suspicious domains often used for exfiltration or C2 [MEDIUM]","category":"other","hardFail":false},{"id":"F-bc0e024530c1","source":"malcontent","ruleId":"r.ac2c093b7105","severity":"info","confidence":0.6,"path":"tests/test_html.js","line":0,"snippet":"['169.254.169.254', '93.184.216.34', '172.16.4.4']","message":"hardcoded IP address [MEDIUM]","category":"other","hardFail":false},{"id":"F-1cadc6a3deca","source":"malcontent","ruleId":"r.49d5f573ce86","severity":"info","confidence":0.6,"path":"tests/test_html.js","line":0,"snippet":"['<html>']","message":"Contains HTML content [MEDIUM]","category":"other","hardFail":false},{"id":"F-caf01e01c9eb","source":"opengrep","ruleId":"r.9e792a11867b","severity":"info","confidence":0.6,"path":"tests/test_html.js","line":128,"snippet":"assert.strictEqual(html.sanitize(\"<img src=\\\"https://93.184.216.34/x.png\\\" width=\\\"90\\\">\",","message":"Network address given as a raw public IP (no DNS name).","category":"network","hardFail":false},{"id":"F-2de9ceed805b","source":"malcontent","ruleId":"r.0a992cf3dce0","severity":"info","confidence":0.6,"path":"tests/test_install.sh","line":0,"snippet":"['bad >/dev/null 2>&1']","message":"Runs shell commands but throws output away [MEDIUM]","category":"other","hardFail":false},{"id":"F-6a6967b3f483","source":"malcontent","ruleId":"r.811077312edb","severity":"info","confidence":0.6,"path":"tests/test_install.sh","line":0,"snippet":"['| sh']","message":"pipes to shell [MEDIUM]","category":"other","hardFail":false},{"id":"F-50315be7a7ff","source":"malcontent","ruleId":"r.b422e837e9e7","severity":"info","confidence":0.6,"path":"tests/test_install.sh","line":0,"snippet":"['rm -rf']","message":"Forcibly deletes files recursively [MEDIUM]","category":"other","hardFail":false},{"id":"F-470d63950bb9","source":"malcontent","ruleId":"r.e764edde6b0e","severity":"info","confidence":0.6,"path":"tests/test_message.js","line":0,"snippet":"['./load']","message":"references and possibly executes relative path [MEDIUM]","category":"other","hardFail":false},{"id":"F-48d32219971c","source":"malcontent","ruleId":"r.e764edde6b0e","severity":"info","confidence":0.6,"path":"tests/test_model.js","line":0,"snippet":"['./load']","message":"references and possibly executes relative path [MEDIUM]","category":"other","hardFail":false},{"id":"F-6a6a00ab2315","source":"malcontent","ruleId":"r.dfefb009e79e","severity":"info","confidence":0.6,"path":"tests/test_model.js","line":0,"snippet":"['daemon']","message":"Run as a background daemon [MEDIUM]","category":"other","hardFail":false},{"id":"F-092e025cfd3e","source":"malcontent","ruleId":"r.11d4044d9aba","severity":"info","confidence":0.6,"path":"tests/test_oauth.js","line":0,"snippet":"['https://accounts.google.com/o/oauth2/v2/auth?', 'require']","message":"contains hardcoded endpoint with a question mark [MEDIUM]","category":"other","hardFail":false},{"id":"F-e0ebd6d8acab","source":"malcontent","ruleId":"r.ef1ffca5d1bd","severity":"info","confidence":0.6,"path":"tests/test_oauth.js","line":0,"snippet":"['clientId']","message":"contains a client ID [MEDIUM]","category":"other","hardFail":false},{"id":"F-cc07937fe286","source":"malcontent","ruleId":"r.49d5f573ce86","severity":"info","confidence":0.6,"path":"tests/test_oauth.js","line":0,"snippet":"['<html>']","message":"Contains HTML content [MEDIUM]","category":"other","hardFail":false},{"id":"F-e7288c33940a","source":"malcontent","ruleId":"r.e764edde6b0e","severity":"info","confidence":0.6,"path":"tests/test_oauth.js","line":0,"snippet":"['./load']","message":"references and possibly executes relative path [MEDIUM]","category":"other","hardFail":false},{"id":"F-4cda02ea2929","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"tests/test_oauth.js","line":0,"snippet":"['HTTP', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-771d0c88d227","source":"gitleaks","ruleId":"r.43cd6c2d96bb","severity":"info","confidence":0.7,"path":"tests/test_oauth.js","line":95,"snippet":"refreshed.refreshToken, \"RED…REDACTED\"","message":"Possible hard-coded secret (Detected a Generic API Key, potentially exposing access to various services and sensitive operations.); value redacted, liveness not verified.","category":"secret","hardFail":false}],"ai":{"pass1":{"status":"ok","output":{"summary":"Partial review: Gmail client plugin using Gmail API, OAuth loopback, keyring, and local cache scripts. Only BarWidget, Accounts.js, BodyCache, Cache.js and the AuthManager excerpt were reviewed; the other files were not read. No malicious behaviour seen in them.","whatItDoes":{"oneLiner":"Gmail client for Omarchy: bar unread count plus a mail window using Google OAuth and the Gmail API, with on-disk caches and helper scripts."},"additionalFindings":[{"severity":"info","path":"AuthManager.qml","line":531,"message":"The sh -c string is built only from the internal requiredTools list, so it is likely not injectable. I did not check that list's source.","category":"exec","snippet":"toolProbe.command = [\"sh\", \"-c\","}],"escalate":false,"escalateReason":"","injectionObserved":false,"injectionNotes":"","canaryObserved":false},"turns":3,"costUsd":0.1046356},"pass2":[{"findingId":"F-88144fd9077e","verdict":"unsure","reason":"Snippet only shows tag-push trigger; no cache action or artifact publishing step visible to judge cache poisoning."},{"findingId":"F-ab1f745eae18","verdict":"confirmed","reason":"actions/checkout@v4 is a mutable tag, not a SHA pin."},{"findingId":"F-e1df16332aac","verdict":"confirmed","reason":"actions/setup-node@v4 is a mutable tag, not a SHA pin."},{"findingId":"F-4df641eedf3a","verdict":"confirmed","reason":"sh -c string built by concatenating requiredTools.join; injection possible if requiredTools is not a static constant (source not shown)."}],"guard":{"canaryOk":true,"positiveControlOk":null,"disallowedToolUse":false,"schemaValid":true,"failures":[]}}}}}],"listing":{"id":"omamail","name":"Omamail","ini":"O","accent":"coral","author":"huacnlee","desc":"Email client for Omarchy: read, triage, and reply to Gmail, HEY and any JMAP or IMAP mailbox in a native window. Fastmail, iCloud, Outlook, Zoho, Proton Bridge, or your own server — several accounts at once, each with its own inbox and unread count. Keyboard-first, three columns when there is room and one when there is not, and it follows your theme. Meeting invitations are drawn as meetings you can answer, newsletters unsubscribe in one click, and remote images stay blocked until you ask.","cat":"Productivity","kind":"Bar widget","tags":["quickshell","bar"],"repo":"https://github.com/huacnlee/omamail","verif":"unverified","listed":"2026-08-20T03:43:03Z","updated":"2026-10-11T12:11:13Z","img":{"thumb":"8-huacnlee-omamail-card.webp","full":"8-huacnlee-omamail-detail.webp","w":1600,"h":871},"gallery":["https://raw.githubusercontent.com/huacnlee/omamail/d4d80f162eacae9a4a6562f24b1a5d8b48987723/docs/images/full-mail.webp","https://raw.githubusercontent.com/huacnlee/omamail/d4d80f162eacae9a4a6562f24b1a5d8b48987723/docs/images/full-calendar.webp","https://raw.githubusercontent.com/huacnlee/omamail/d4d80f162eacae9a4a6562f24b1a5d8b48987723/docs/images/full-compose.webp","https://raw.githubusercontent.com/huacnlee/omamail/d4d80f162eacae9a4a6562f24b1a5d8b48987723/docs/images/mini-list.webp"],"gh":{"stars":304,"vel30":51,"lastCommit":"2026-10-19T02:08:34Z","c90":297,"contrib":31,"bus":1,"rel180":20,"lastRelease":"v0.11.0","issues":31,"respH":43.0,"archived":false,"branch":"main"},"mkt":{"views":18866,"copies":3989,"hearts":168},"rank":8,"score":78.34,"fac":[16.4,10.6,10.9,11.0,8.0,8.0,2.5,9.4,1.5],"verdict":{"combined":"caution","basis":"trusted","providers":{"marketplace":"caution","opc":"caution"},"commit":"3d0d673715cb0fb4f49cb718c2a2dbc002ee8763","tree":"c3802736d515a6e9e3d7bf83503322c3101d4e7b","criteria":{"checked":["safe-to-run","no-network","no-exec","no-persistence","no-privilege","no-obfuscation","no-secrets"],"failed":["no-network","no-exec"]},"risk":13},"report":true,"license":"MIT","version":"0.11.0"},"activity":{"weeks":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,9,35,15,14,20,7]}}