Trust & security
Trust starts with evidence.
A check should tell you exactly what it checked. Here’s what the labels mean, what they miss, and how to inspect a plugin yourself.
Omarchy plugins run unsandboxed with your user permissions. Automated checks do not establish that code is safe.
Separate checks from human judgment.
Unverified
This exact commit has not received human approval. Automated scan results, where available, are separate.
Verified
A configured reviewer approved this exact commit after inspecting its source, manifest, capability evidence, and checklist. Future commits do not inherit this approval.
What a check can’t tell you
The registry does not execute submitted code or test it against your installed shell. Static source patterns flag process execution, network access, file access, downloads and other capabilities with file and line evidence. They cannot detect every dangerous behavior.
Dependencies, shell scripts, downloaded code, and QML imports need separate review. A passing npm audit applies to its npm dependency tree, not the rest of a plugin.
Inspect the supply chain
- Read the exact commit and compare it with the version you use.
- Check upstream security advisories and the dependency graph.
- Review maintainer history and unexpected ownership changes.
- Check ecosystem-specific dependency audits where they apply.
Stars and repository age provide context. They are not safety scores. Downloads and installations are not measured; copying a command is not a download.
Versions stay tied to their commits
Every scan records its version and exact SHA. Every human decision records the reviewer, timestamp, checklist, notes and scan. Changes remain separate snapshots even if upstream did not bump the version.
GitHub comments form the public ledger. They are not a cryptographically immutable log: privileged administrators can remove them. Keep copies of receipts you rely on.
Know what you install
The standard Omarchy marketplace command follows upstream code and may not install the commit shown here. This registry links to the recorded snapshot. Inspect that source and the upstream installation instructions before proceeding.
Report a concern
Report privately on GitHub ↗. Use the report form on any plugin page for public reports. Reviewers can revoke affected commits with a reason and advisory recommendation. Revoked snapshots remain visible; the registry cannot remove software already installed on your computer.