All plugins

@nuu-maan/omarchy-widgets

Widgets v0.2.0

Desktop widgets that sit on your wallpaper and take their colors from your Omarchy theme. Choose which ones are on screen from the bar.

Unverified

Start with the source

Version 0.2.0

Read the code and installation instructions at this exact commit.

Inspect source
Source commit9265e49ed7bd52b87a86840044dda6462cb6002d

The standard Omarchy install command follows upstream code and may install a different commit. Check the repository’s instructions before installing.

Release history

1 release
Published versions of Widgets
VersionPublishedPublisherRecord
v0.2.0Sep 9, 2026Nuu-maanReceipt ↗

What was checked

Manifest structure, declared files, QML parsing, repository identity and bounded source analysis passed at this commit.

PENDING REVIEW

Waiting for human review. No verification has been granted.

Security capabilities

Last scan: Sep 9, 2026

Automated security analysis is not a guarantee that a plugin is safe. “No match” means the scanner did not recognize a pattern; it is not proof of absence.

network · 26 matches

Model.js:1774if (isSafeRepo(candidates[i])) return "https://github.com/" + candidates[i]

Service.qml:387"https://wttr.in/" + query + "?format=j1"]

Service.qml:470"https://github.com/users/" + login + "/contributions"]

Service.qml:562"https://api.github.com/repos/" + name]

Service.qml:604"https://api.github.com/search/issues?per_page=1&q=repo:"

install:31# curl -fsSL https://raw.githubusercontent.com/anishfn/omarchy-widgets/main/install | bash -s -- --yes

install:39URL="https://github.com/anishfn/omarchy-widgets.git"

install:48"palccod.omate|https://github.com/Palccod/Omate.git|the Omate card|the desktop pet's switch, its skins, and its dials"

manifest.json:9"repository": "https://github.com/anishfn/omarchy-widgets",

tests/model.test.js:1523"https://github.com/Nuu-maan/Filly-Discord-Token-Filler")

tests/model.test.js:1526assert.equal(Model.repoUrl(null, "cli/cli"), "https://github.com/cli/cli")

tests/model.test.js:1547"https://github.com/cli/cli")

shell · 19 matches

Editor.qml:24property var shell: null

Editor.qml:364shell: root.shell

Editor.qml:845shell: root.shell

Service.qml:16property var shell: null

Service.qml:236// and it is cheap: one short-lived bash for every zone in the config,

Service.qml:261zoneProc.command = ["/usr/bin/timeout", "-k", "2", "5", "/usr/bin/bash", "-c", service.zoneScript, "--"].concat(zones)

Surface.qml:25property var shell: null

Surface.qml:171shell: root.shell

Surface.qml:188item.shell = root.shell

WidgetInstance.qml:20property var shell: null

WidgetInstance.qml:53if ("shell" in item) item.shell = root.shell

dev/preview:1#!/bin/bash

process · 35 matches

Model.js:1980while ((match = pattern.exec(html)) !== null) {

Model.js:2225// should not have to wait for a subprocess to answer.

Model.js:2403var m = /^([+-])(\d{2})(\d{2})(\d{2})?$/.exec(String(value || "").replace(/^\s+|\s+$/g, ""))

Model.js:2417var m = /^(\d{4})(\d{2})(\d{2})(?:T(\d{2})(\d{2})(\d{2})(Z)?)?$/.exec(s)

Model.js:2456var weeks = /^P(\d+)W$/.exec(s)

Model.js:2458var m = /^P(?:(\d+)D)?(?:T(?:(\d+)H)?(?:(\d+)M)?(?:(\d+)S)?)?$/.exec(s)

Model.js:2514var m = /^([+-]?\d{1,2})?(SU|MO|TU|WE|TH|FR|SA)$/.exec(days[d])

Model.js:2691// zoneinfo lookup the shell would have to run a subprocess for.

Model.js:2857// from the network being turned into objects inside the process that draws

Model.js:3167var todoTxt = /^x\s+(?:\d{4}-\d{2}-\d{2}\s+)?(.*)$/.exec(rest)

Model.js:3172var box = /^\[([ xX\u00d7~-])\]\s*(.*)$/.exec(rest)

Model.js:3180var bang = /^!+\s*(.*)$/.exec(rest)

filesystemRead · 6 matches

Service.qml:217FileView {

Service.qml:224// Absent on first run. FileView reports that as a failure rather than as

Service.qml:356FileView {

Service.qml:825delegate: FileView {

dev/preview:45cat > "$ROOT/shell.qml" <<EOF

install:242cat <<'NEXT'

filesystemWrite · 12 matches

Inspector.qml:9// then Duplicate and Remove, then whatever its schema asked for, all reading

Inspector.qml:97// Duplicate and Remove sit up here with the name rather than under the

Inspector.qml:99// be told, and a Remove at the bottom of a list of fields is a Remove

Inspector.qml:180text: "Remove"

Service.qml:208configFile.setText(text)

Service.qml:804view.setText(next)

Service.qml:1100function remove(id: string): string {

dev/preview:40rm -rf "$ROOT"

dev/preview:41mkdir -p "$ROOT"

dev/preview:85trap 'rm -rf "$ROOT"' EXIT

tests/model.test.js:410for (const bad of ["../../etc/passwd", "Asia/Kolkata; rm -rf ~", "$(id)", "/etc/localtime"]) {

tests/model.test.js:2104for (const bad of ["", "/etc/passwd", "../../etc/passwd", "Asia/../..", "Asia/Kolkata; rm -rf ~",

environment · 162 matches

Service.qml:18property string omarchyPath: Quickshell.env("OMARCHY_PATH")

Service.qml:20readonly property string home: Quickshell.env("HOME")

Service.qml:246' if [ -f "/usr/share/zoneinfo/$z" ]; then\n' +

Service.qml:247' printf \'%s\\t%s\\n\' "$z" "$(TZ=":/usr/share/zoneinfo/$z" date +%z)"\n' +

Service.qml:249' printf \'%s\\t\\n\' "$z"\n' +

dev/preview:29ROOT=${XDG_RUNTIME_DIR:-/tmp}/omarchy-widgets-preview

dev/preview:32[ -d "$SHELL_DIR/Commons" ] || { echo "Omarchy shell not found at $SHELL_DIR" >&2; exit 1; }

dev/preview:40rm -rf "$ROOT"

dev/preview:41mkdir -p "$ROOT"

dev/preview:42ln -s "$SHELL_DIR/Commons" "$ROOT/Commons"

dev/preview:43ln -s "$SHELL_DIR/Ui" "$ROOT/Ui"

dev/preview:45cat > "$ROOT/shell.qml" <<EOF

downloads · 12 matches

Model.js:2313// curl, so it is matched against a pattern rather than escaped -- an

Service.qml:383// and the whole thing is passed as one argv entry to curl.

Service.qml:386"/usr/bin/curl", "-fsS", "--max-time", "15",

Service.qml:469"/usr/bin/curl", "-fsS", "--max-time", "20",

Service.qml:560"/usr/bin/curl", "-fsSL", "--max-time", "15",

Service.qml:602"/usr/bin/curl", "-fsSL", "--max-time", "20",

Service.qml:697// about to be handed to curl as a URL.

Service.qml:703"/usr/bin/curl", "-fsSL", "--max-time", "30",

install:21# Missing curl is not an install failure; it is four cards that never

install:31# curl -fsSL https://raw.githubusercontent.com/anishfn/omarchy-widgets/main/install | bash -s -- --yes

install:124"/usr/bin/curl|weather, the contribution graph, repo pulse and the calendar fetch with it" \

tests/model.test.js:1982test("a report also parses from the raw string curl hands back", () => {

downloadExecution · 1 matches

install:31# curl -fsSL https://raw.githubusercontent.com/anishfn/omarchy-widgets/main/install | bash -s -- --yes

obfuscation · No match
credentials · 19 matches

Model.js:249description: "What is next, from your Google Calendar's secret iCal address.",

Model.js:256// decoration holding an OAuth token. One GET to Google's own host, no

Model.js:265label: "Secret iCal address",

Model.js:830// non-empty text setting" -- would put a calendar's secret address in the

Model.js:1934// /users/<login>/contributions and needs no token. That is the whole source:

Model.js:2240function parseOffsetToken(token) {

Model.js:2241var m = String(token || "").match(/^([+-])(\d{2})(\d{2})$/)

Model.js:2291// Google Calendar publishes every calendar as an iCalendar file at a secret

Model.js:2292// address: Settings -> Integrate calendar -> "Secret address in iCal format".

Model.js:2294// refresh token for a wallpaper decoration to hold, and no third party in the

Model.js:2312// The secret address, to Google's own shape. This becomes a URL handed to

Service.qml:422// /users/<login>/contributions and needs no token. So this goes to

Automated validation details

Static pattern analysis and qmllint parsing. Up to 12 evidence samples per capability; all matching lines counted. Absence of a match does not establish absence of a capability.

  • BarWidget.qml: parsed, 412 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • Editor.qml: parsed, 1019 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • Field.qml: parsed, 70 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • Inspector.qml: parsed, 425 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • PickerField.qml: parsed, 391 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • Service.qml: parsed, 376 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • SettingField.qml: parsed, 304 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • Surface.qml: parsed, 123 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • WidgetCard.qml: parsed, 43 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • WidgetInstance.qml: parsed, 45 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • WidgetRow.qml: parsed, 170 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • WidgetsMark.qml: parsed, 72 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • widgets/Calendar.qml: parsed, 477 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • widgets/Clock.qml: parsed, 187 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • widgets/Github.qml: parsed, 287 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • widgets/Music.qml: parsed, 760 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • widgets/MusicButton.qml: parsed, 96 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • widgets/Omate.qml: parsed, 935 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • widgets/Photo.qml: parsed, 272 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • widgets/RepoPulse.qml: parsed, 278 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • widgets/TickRing.qml: parsed, 55 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • widgets/Todos.qml: parsed, 557 diagnostics. Static parser only; Omarchy imports may be unavailable.
  • widgets/Weather.qml: parsed, 276 diagnostics. Static parser only; Omarchy imports may be unavailable.
Manifest at this commit
{
  "schemaVersion": 1,
  "id": "anishfn.widgets",
  "name": "Widgets",
  "version": "0.2.0",
  "author": "anishfn",
  "license": "MIT",
  "description": "Desktop widgets that sit on your wallpaper and take their colors from your Omarchy theme. Choose which ones are on screen from the bar.",
  "repository": "https://github.com/anishfn/omarchy-widgets",
  "keywords": [
    "widgets",
    "desktop",
    "clock",
    "wallpaper",
    "quickshell"
  ],
  "kinds": [
    "panel",
    "bar-widget",
    "service"
  ],
  "keepLoaded": true,
  "entryPoints": {
    "panel": "Surface.qml",
    "barWidget": "BarWidget.qml",
    "service": "Service.qml"
  },
  "barWidget": {
    "displayName": "Widgets",
    "description": "Choose which desktop widgets are on screen.",
    "category": "Desktop",
    "allowMultiple": false,
    "defaultSection": "right",
    "defaults": {
      "showCount": false
    },
    "schema": [
      {
        "key": "showCount",
        "type": "boolean",
        "label": "Show how many widgets are on",
        "defaultValue": false
      }
    ]
  }
}

Review history

No human review recorded.

Report this plugin

A report requests a rescan and moderation. It does not remove a plugin automatically.

For authorized reviewers

Review this plugin

Inspect the source and scan above, choose a decision, then submit the prepared issue on GitHub. Only configured reviewer accounts can record a decision.

Reviewing commit 9265e49ed7bd52b87a86840044dda6462cb6002d. GitHub identity is checked by the registry before any decision is recorded.

Code review checklist

All notes are public. Do not include credentials or private vulnerability details.

Next: sign in with your reviewer account and submit the GitHub issue. Opening the draft does not record your decision.

  • Service.qml: process execution, privilege escalation, or network access; inspect source

These checks do not include runtime testing or a full dependency audit. Plugins run with your user permissions. Read the verification policy.

Manifest SHA-256 digest
6a85364322bf3b6c557249edb7959c48d56a5c2b2f2e14ce6b50f6c77d08292e