@nuu-maan/omarchy-widgets
Widgets v0.2.0
Desktop widgets that sit on your wallpaper and take their colors from your Omarchy theme. Choose which ones are on screen from the bar.
Start with the source
Version 0.2.0Read the code and installation instructions at this exact commit.
Inspect source9265e49ed7bd52b87a86840044dda6462cb6002dThe standard Omarchy install command follows upstream code and may install a different commit. Check the repository’s instructions before installing.
Release history
1 release| Version | Published | Publisher | Record |
|---|---|---|---|
| v0.2.0 | Sep 9, 2026 | Nuu-maan | Receipt ↗ |
What was checked
Manifest structure, declared files, QML parsing, repository identity and bounded source analysis passed at this commit.
PENDING REVIEW
Waiting for human review. No verification has been granted.
Security capabilities
Last scan: Sep 9, 2026Automated security analysis is not a guarantee that a plugin is safe. “No match” means the scanner did not recognize a pattern; it is not proof of absence.
network · 26 matches
Model.js:1774 ↗if (isSafeRepo(candidates[i])) return "https://github.com/" + candidates[i]
Service.qml:387 ↗"https://wttr.in/" + query + "?format=j1"]
Service.qml:470 ↗"https://github.com/users/" + login + "/contributions"]
Service.qml:562 ↗"https://api.github.com/repos/" + name]
Service.qml:604 ↗"https://api.github.com/search/issues?per_page=1&q=repo:"
install:31 ↗# curl -fsSL https://raw.githubusercontent.com/anishfn/omarchy-widgets/main/install | bash -s -- --yes
install:39 ↗URL="https://github.com/anishfn/omarchy-widgets.git"
install:48 ↗"palccod.omate|https://github.com/Palccod/Omate.git|the Omate card|the desktop pet's switch, its skins, and its dials"
manifest.json:9 ↗"repository": "https://github.com/anishfn/omarchy-widgets",
tests/model.test.js:1523 ↗"https://github.com/Nuu-maan/Filly-Discord-Token-Filler")
tests/model.test.js:1526 ↗assert.equal(Model.repoUrl(null, "cli/cli"), "https://github.com/cli/cli")
tests/model.test.js:1547 ↗"https://github.com/cli/cli")
shell · 19 matches
Editor.qml:24 ↗property var shell: null
Editor.qml:364 ↗shell: root.shell
Editor.qml:845 ↗shell: root.shell
Service.qml:16 ↗property var shell: null
Service.qml:236 ↗// and it is cheap: one short-lived bash for every zone in the config,
Service.qml:261 ↗zoneProc.command = ["/usr/bin/timeout", "-k", "2", "5", "/usr/bin/bash", "-c", service.zoneScript, "--"].concat(zones)
Surface.qml:25 ↗property var shell: null
Surface.qml:171 ↗shell: root.shell
Surface.qml:188 ↗item.shell = root.shell
WidgetInstance.qml:20 ↗property var shell: null
WidgetInstance.qml:53 ↗if ("shell" in item) item.shell = root.shell
dev/preview:1 ↗#!/bin/bash
process · 35 matches
Model.js:1980 ↗while ((match = pattern.exec(html)) !== null) {
Model.js:2225 ↗// should not have to wait for a subprocess to answer.
Model.js:2403 ↗var m = /^([+-])(\d{2})(\d{2})(\d{2})?$/.exec(String(value || "").replace(/^\s+|\s+$/g, ""))
Model.js:2417 ↗var m = /^(\d{4})(\d{2})(\d{2})(?:T(\d{2})(\d{2})(\d{2})(Z)?)?$/.exec(s)
Model.js:2456 ↗var weeks = /^P(\d+)W$/.exec(s)
Model.js:2458 ↗var m = /^P(?:(\d+)D)?(?:T(?:(\d+)H)?(?:(\d+)M)?(?:(\d+)S)?)?$/.exec(s)
Model.js:2514 ↗var m = /^([+-]?\d{1,2})?(SU|MO|TU|WE|TH|FR|SA)$/.exec(days[d])
Model.js:2691 ↗// zoneinfo lookup the shell would have to run a subprocess for.
Model.js:2857 ↗// from the network being turned into objects inside the process that draws
Model.js:3167 ↗var todoTxt = /^x\s+(?:\d{4}-\d{2}-\d{2}\s+)?(.*)$/.exec(rest)
Model.js:3172 ↗var box = /^\[([ xX\u00d7~-])\]\s*(.*)$/.exec(rest)
Model.js:3180 ↗var bang = /^!+\s*(.*)$/.exec(rest)
filesystemRead · 6 matches
Service.qml:217 ↗FileView {
Service.qml:224 ↗// Absent on first run. FileView reports that as a failure rather than as
Service.qml:356 ↗FileView {
Service.qml:825 ↗delegate: FileView {
dev/preview:45 ↗cat > "$ROOT/shell.qml" <<EOF
install:242 ↗cat <<'NEXT'
filesystemWrite · 12 matches
Inspector.qml:9 ↗// then Duplicate and Remove, then whatever its schema asked for, all reading
Inspector.qml:97 ↗// Duplicate and Remove sit up here with the name rather than under the
Inspector.qml:99 ↗// be told, and a Remove at the bottom of a list of fields is a Remove
Inspector.qml:180 ↗text: "Remove"
Service.qml:208 ↗configFile.setText(text)
Service.qml:804 ↗view.setText(next)
Service.qml:1100 ↗function remove(id: string): string {
dev/preview:40 ↗rm -rf "$ROOT"
dev/preview:41 ↗mkdir -p "$ROOT"
dev/preview:85 ↗trap 'rm -rf "$ROOT"' EXIT
tests/model.test.js:410 ↗for (const bad of ["../../etc/passwd", "Asia/Kolkata; rm -rf ~", "$(id)", "/etc/localtime"]) {
tests/model.test.js:2104 ↗for (const bad of ["", "/etc/passwd", "../../etc/passwd", "Asia/../..", "Asia/Kolkata; rm -rf ~",
environment · 162 matches
Service.qml:18 ↗property string omarchyPath: Quickshell.env("OMARCHY_PATH")
Service.qml:20 ↗readonly property string home: Quickshell.env("HOME")
Service.qml:246 ↗' if [ -f "/usr/share/zoneinfo/$z" ]; then\n' +
Service.qml:247 ↗' printf \'%s\\t%s\\n\' "$z" "$(TZ=":/usr/share/zoneinfo/$z" date +%z)"\n' +
Service.qml:249 ↗' printf \'%s\\t\\n\' "$z"\n' +
dev/preview:29 ↗ROOT=${XDG_RUNTIME_DIR:-/tmp}/omarchy-widgets-preview
dev/preview:32 ↗[ -d "$SHELL_DIR/Commons" ] || { echo "Omarchy shell not found at $SHELL_DIR" >&2; exit 1; }
dev/preview:40 ↗rm -rf "$ROOT"
dev/preview:41 ↗mkdir -p "$ROOT"
dev/preview:42 ↗ln -s "$SHELL_DIR/Commons" "$ROOT/Commons"
dev/preview:43 ↗ln -s "$SHELL_DIR/Ui" "$ROOT/Ui"
dev/preview:45 ↗cat > "$ROOT/shell.qml" <<EOF
downloads · 12 matches
Model.js:2313 ↗// curl, so it is matched against a pattern rather than escaped -- an
Service.qml:383 ↗// and the whole thing is passed as one argv entry to curl.
Service.qml:386 ↗"/usr/bin/curl", "-fsS", "--max-time", "15",
Service.qml:469 ↗"/usr/bin/curl", "-fsS", "--max-time", "20",
Service.qml:560 ↗"/usr/bin/curl", "-fsSL", "--max-time", "15",
Service.qml:602 ↗"/usr/bin/curl", "-fsSL", "--max-time", "20",
Service.qml:697 ↗// about to be handed to curl as a URL.
Service.qml:703 ↗"/usr/bin/curl", "-fsSL", "--max-time", "30",
install:21 ↗# Missing curl is not an install failure; it is four cards that never
install:31 ↗# curl -fsSL https://raw.githubusercontent.com/anishfn/omarchy-widgets/main/install | bash -s -- --yes
install:124 ↗"/usr/bin/curl|weather, the contribution graph, repo pulse and the calendar fetch with it" \
tests/model.test.js:1982 ↗test("a report also parses from the raw string curl hands back", () => {
downloadExecution · 1 matches
install:31 ↗# curl -fsSL https://raw.githubusercontent.com/anishfn/omarchy-widgets/main/install | bash -s -- --yes
obfuscation · No match
credentials · 19 matches
Model.js:249 ↗description: "What is next, from your Google Calendar's secret iCal address.",
Model.js:256 ↗// decoration holding an OAuth token. One GET to Google's own host, no
Model.js:265 ↗label: "Secret iCal address",
Model.js:830 ↗// non-empty text setting" -- would put a calendar's secret address in the
Model.js:1934 ↗// /users/<login>/contributions and needs no token. That is the whole source:
Model.js:2240 ↗function parseOffsetToken(token) {
Model.js:2241 ↗var m = String(token || "").match(/^([+-])(\d{2})(\d{2})$/)
Model.js:2291 ↗// Google Calendar publishes every calendar as an iCalendar file at a secret
Model.js:2292 ↗// address: Settings -> Integrate calendar -> "Secret address in iCal format".
Model.js:2294 ↗// refresh token for a wallpaper decoration to hold, and no third party in the
Model.js:2312 ↗// The secret address, to Google's own shape. This becomes a URL handed to
Service.qml:422 ↗// /users/<login>/contributions and needs no token. So this goes to
Automated validation details
Static pattern analysis and qmllint parsing. Up to 12 evidence samples per capability; all matching lines counted. Absence of a match does not establish absence of a capability.
- BarWidget.qml: parsed, 412 diagnostics. Static parser only; Omarchy imports may be unavailable.
- Editor.qml: parsed, 1019 diagnostics. Static parser only; Omarchy imports may be unavailable.
- Field.qml: parsed, 70 diagnostics. Static parser only; Omarchy imports may be unavailable.
- Inspector.qml: parsed, 425 diagnostics. Static parser only; Omarchy imports may be unavailable.
- PickerField.qml: parsed, 391 diagnostics. Static parser only; Omarchy imports may be unavailable.
- Service.qml: parsed, 376 diagnostics. Static parser only; Omarchy imports may be unavailable.
- SettingField.qml: parsed, 304 diagnostics. Static parser only; Omarchy imports may be unavailable.
- Surface.qml: parsed, 123 diagnostics. Static parser only; Omarchy imports may be unavailable.
- WidgetCard.qml: parsed, 43 diagnostics. Static parser only; Omarchy imports may be unavailable.
- WidgetInstance.qml: parsed, 45 diagnostics. Static parser only; Omarchy imports may be unavailable.
- WidgetRow.qml: parsed, 170 diagnostics. Static parser only; Omarchy imports may be unavailable.
- WidgetsMark.qml: parsed, 72 diagnostics. Static parser only; Omarchy imports may be unavailable.
- widgets/Calendar.qml: parsed, 477 diagnostics. Static parser only; Omarchy imports may be unavailable.
- widgets/Clock.qml: parsed, 187 diagnostics. Static parser only; Omarchy imports may be unavailable.
- widgets/Github.qml: parsed, 287 diagnostics. Static parser only; Omarchy imports may be unavailable.
- widgets/Music.qml: parsed, 760 diagnostics. Static parser only; Omarchy imports may be unavailable.
- widgets/MusicButton.qml: parsed, 96 diagnostics. Static parser only; Omarchy imports may be unavailable.
- widgets/Omate.qml: parsed, 935 diagnostics. Static parser only; Omarchy imports may be unavailable.
- widgets/Photo.qml: parsed, 272 diagnostics. Static parser only; Omarchy imports may be unavailable.
- widgets/RepoPulse.qml: parsed, 278 diagnostics. Static parser only; Omarchy imports may be unavailable.
- widgets/TickRing.qml: parsed, 55 diagnostics. Static parser only; Omarchy imports may be unavailable.
- widgets/Todos.qml: parsed, 557 diagnostics. Static parser only; Omarchy imports may be unavailable.
- widgets/Weather.qml: parsed, 276 diagnostics. Static parser only; Omarchy imports may be unavailable.
Manifest at this commit
{
"schemaVersion": 1,
"id": "anishfn.widgets",
"name": "Widgets",
"version": "0.2.0",
"author": "anishfn",
"license": "MIT",
"description": "Desktop widgets that sit on your wallpaper and take their colors from your Omarchy theme. Choose which ones are on screen from the bar.",
"repository": "https://github.com/anishfn/omarchy-widgets",
"keywords": [
"widgets",
"desktop",
"clock",
"wallpaper",
"quickshell"
],
"kinds": [
"panel",
"bar-widget",
"service"
],
"keepLoaded": true,
"entryPoints": {
"panel": "Surface.qml",
"barWidget": "BarWidget.qml",
"service": "Service.qml"
},
"barWidget": {
"displayName": "Widgets",
"description": "Choose which desktop widgets are on screen.",
"category": "Desktop",
"allowMultiple": false,
"defaultSection": "right",
"defaults": {
"showCount": false
},
"schema": [
{
"key": "showCount",
"type": "boolean",
"label": "Show how many widgets are on",
"defaultValue": false
}
]
}
}Review history
No human review recorded.
Report this plugin
For authorized reviewers
Review this plugin
Inspect the source and scan above, choose a decision, then submit the prepared issue on GitHub. Only configured reviewer accounts can record a decision.
- Service.qml: process execution, privilege escalation, or network access; inspect source
These checks do not include runtime testing or a full dependency audit. Plugins run with your user permissions. Read the verification policy.
Manifest SHA-256 digest
6a85364322bf3b6c557249edb7959c48d56a5c2b2f2e14ce6b50f6c77d08292e