Menu

Not in the top 1,000 by GitHub stars

tcballard/build-omarchy-plugins

Claude CodeCodexEngineering

History

Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.

View weekly changes

plugins/build-omarchy-plugins/skills/omarchy-bar-widget/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Instructions only

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

plugins/build-omarchy-plugins/skills/omarchy-panel-overlay/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Instructions only

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

plugins/build-omarchy-plugins/skills/omarchy-plugin-debug/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

plugins/build-omarchy-plugins/skills/omarchy-plugin-demo/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

plugins/build-omarchy-plugins/skills/omarchy-plugin-design/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

plugins/build-omarchy-plugins/skills/omarchy-plugin-migrate/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

plugins/build-omarchy-plugins/skills/omarchy-plugin-publish/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

plugins/build-omarchy-plugins/skills/omarchy-plugin-release/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Local scripts

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Local scripts

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

plugins/build-omarchy-plugins/skills/omarchy-plugin-test/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

plugins/build-omarchy-plugins/skills/omarchy-qml-patterns/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

plugins/build-omarchy-plugins/skills/omarchy-service-ipc/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

skills/omarchy-bar-widget/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Instructions only

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

skills/omarchy-panel-overlay/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Instructions only

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

skills/omarchy-plugin-debug/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

skills/omarchy-plugin-demo/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

skills/omarchy-plugin-design/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

skills/omarchy-plugin-migrate/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

skills/omarchy-plugin-publish/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

skills/omarchy-plugin-release/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Local scripts

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

skills/omarchy-plugin-scaffold/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Local scripts

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

skills/omarchy-plugin-test/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

skills/omarchy-qml-patterns/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

skills/omarchy-service-ipc/SKILL.md

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 6dd10a7652ae

No earlier version was observed for comparison.

Compare on GitHub

View on GitHubAdd to my skills

Verified commit 6dd10a7652ae48e3ddb4ce74d1d4b83549ba5fae

git clone --filter=blob:none --no-checkout https://github.com/tcballard/build-omarchy-plugins.git .hotskills/tcballard-build-omarchy-plugins && git -C .hotskills/tcballard-build-omarchy-plugins checkout --detach 6dd10a7652ae48e3ddb4ce74d1d4b83549ba5fae # Copy each selected skill directory from .hotskills/tcballard-build-omarchy-plugins into .claude/skills/<skill-name>/
git clone --filter=blob:none --no-checkout https://github.com/tcballard/build-omarchy-plugins.git .hotskills/tcballard-build-omarchy-plugins && git -C .hotskills/tcballard-build-omarchy-plugins checkout --detach 6dd10a7652ae48e3ddb4ce74d1d4b83549ba5fae # Copy each selected skill directory from .hotskills/tcballard-build-omarchy-plugins into .agents/skills/<skill-name>/
106GitHub stars
0stars in 7 days
24skills in this repository
23commits in 30 days

Heat

1.7
  • Star growth, last 7 daysNot available
  • Star growth, last 24 hoursNot available
  • Rank movement, last 7 daysNot available
  • Commits, last 30 daysNot available
  • Accounts asking about it through MCP, last 7 daysNot available
  • Hot votes this weekNot available

Heat never changes the order by stars, and sponsorship never touches it. How heat works

Stars over time

Oct 25, 2026Nov 6, 2026106

30-day change not yet available: not enough history.

Individual skills in this repository

How it works

omarchy-bar-widget

When your agent uses it

Build or refactor an Omarchy Quattro bar-widget implementation, including settings, orientation, popouts, instances and shared services. Use for widget QML or behaviour; global bar styling belongs to theme skills, and replacing the entire bar is outside this skill.

What it loads into context

Frontmatter

61 tokens

Always available to the agent

SKILL.md

388 tokens

When the skill is activated

Reference documents

997 tokens

Loaded on request

Token counts are estimates. Scripts run separately; they are not counted as reference context.

The playbook

    Files

    • ../../../../.claude-plugin/marketplace.jsonasset390 bytes
    • ../../../../.claude-plugin/plugin.jsonasset586 bytes
    • SKILL.mdcore1,890 bytes
    • agents/openai.yamlasset208 bytes
    • references/settings-schema.mddoc1,275 bytes
    • references/widget-contract.mddoc3,105 bytes
    Read SKILL.md
    
# Build an Omarchy bar widget

Inspect the existing manifest, widget and installed host. Use `BarWidget` and `WidgetButton`; preserve settings and behavior outside the requested change.

- Map `entryPoints.barWidget` to the real file and set `moduleName` to the plugin ID.
- Use `root.bar`, `root.settings` and `setting(key, fallback)`. Store ordinary options inline in `shell.json`, not in a nested `config` or separate settings file.
- Support horizontal and vertical bars. Keep selection, hover and open state per instance; share polling and cross-monitor data through a service only when needed.
- For a popout, expose `opened`, `open()` and `close()` and preserve anchor/settings injection. Check placement from the tray drawer as well as bar edges.
- Set `allowMultiple` only when independent concurrent instances make sense.
- Current Quattro accepts `left`, `centerBegin`, `center`, `centerEnd`, `right`, `tray` as `defaultSection`. Automatic placement maps `center` to `centerEnd`; use the side sections to sit beside the clock without shifting it. Check older hosts before relying on new sections.

Read [widget contract](references/widget-contract.md) for QML shape and [settings schema](references/settings-schema.md) when adding options. Use QML patterns for theme, translations and shared implementation; change global theme tokens through the theme workflow.

Verify affected pointer, keyboard, orientation, placement and failure paths. Report which live-host checks were observed and which remain unrun; portable validation alone does not prove popup geometry.
    View the complete source on GitHub

    Skills included

    • omarchy-bar-widget
    • omarchy-panel-overlay
    • omarchy-plugin-debug
    • omarchy-plugin-demo
    • omarchy-plugin-design
    • omarchy-plugin-migrate
    • omarchy-plugin-publish
    • omarchy-plugin-release
    • omarchy-plugin-scaffold
    • omarchy-plugin-test
    • omarchy-qml-patterns
    • omarchy-service-ipc
    • omarchy-bar-widget
    • omarchy-panel-overlay
    • omarchy-plugin-debug
    • omarchy-plugin-demo
    • omarchy-plugin-design
    • omarchy-plugin-migrate
    • omarchy-plugin-publish
    • omarchy-plugin-release
    • omarchy-plugin-scaffold
    • omarchy-plugin-test
    • omarchy-qml-patterns
    • omarchy-service-ipc

    Repository facts

    License
    MIT
    Created
    Aug 29, 2026
    Last pushed
    Oct 30, 2026
    Forks
    3
    Open issues
    1
    Project activity
    Active

    Before you install

    Network or broad shell

    Automated signals, not a guarantee

    Checked Nov 5, 2026

    Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.

    Show 18 notes
    • plugins/build-omarchy-plugins/skills/omarchy-plugin-debug/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • plugins/build-omarchy-plugins/skills/omarchy-plugin-demo/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • plugins/build-omarchy-plugins/skills/omarchy-plugin-publish/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • plugins/build-omarchy-plugins/skills/omarchy-plugin-release/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • plugins/build-omarchy-plugins/skills/omarchy-plugin-test/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • plugins/build-omarchy-plugins/skills/omarchy-plugin-test/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • plugins/build-omarchy-plugins/skills/omarchy-plugin-test/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • plugins/build-omarchy-plugins/skills/omarchy-qml-patterns/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • skills/omarchy-plugin-debug/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • skills/omarchy-plugin-demo/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • skills/omarchy-plugin-publish/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • skills/omarchy-plugin-release/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • skills/omarchy-plugin-scaffold/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • skills/omarchy-plugin-test/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • skills/omarchy-plugin-test/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • skills/omarchy-plugin-test/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    • skills/omarchy-qml-patterns/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
    Show all 686 signals by file

    .claude-plugin/plugin.json

    • Network accessline 5
      "author": {     "name": "Tom Ballard",     "url": "https://github.com/tcballard"
    • Network accessline 6
      "name": "Tom Ballard",     "url": "https://github.com/tcballard"   },
    • Network accessline 7
      "url": "https://github.com/tcballard"
    • Network accessline 8
      },   "homepage": "https://github.com/tcballard/build-omarchy-plugins",   "repository": "https://github.com/tcballard/build-omarchy-plugins",
    • Network accessline 9
      "homepage": "https://github.com/tcballard/build-omarchy-plugins",
    • Network accessline 10
      "repository": "https://github.com/tcballard/build-omarchy-plugins",

    plugins/build-omarchy-plugins/skills/omarchy-bar-widget/references/widget-contract.md

    • Network accessline 67
      Quattro's [reviewed 29 September contract](https://github.com/omacom/omarchy/blob/e332dc975d5f635294c497ebb54feb98dc3d89eb/docs/omarchy-shell.md)

    plugins/build-omarchy-plugins/skills/omarchy-plugin-debug/references/failure-ladder.md

    • Dangerous shell operationline 25
      omarchy debug --no-sudo --print
    • Network accessline 50
      Source: [reviewed shell contract](https://github.com/omacom/omarchy/blob/e332dc975d5f635294c497ebb54feb98dc3d89eb/docs/omarchy-shell.md).

    plugins/build-omarchy-plugins/skills/omarchy-plugin-debug/scripts/doctor.py

    • Executable scriptline 1
      #!/usr/bin/env python3
    • Access to secretsline 101
      [Credential-related source omitted]

    plugins/build-omarchy-plugins/skills/omarchy-plugin-demo/scripts/demo_preflight.py

    • Executable scriptline 1
      #!/usr/bin/env python3
    • Dangerous shell operationline 68
      if "rm -rf" in text:

    plugins/build-omarchy-plugins/skills/omarchy-plugin-design/references/host-workflow.md

    • Network accessline 33
      Sources: [starter](https://github.com/omacom/omarchy/blob/cce8b1c971df64a7610b818ff8819e4bea04584a/shell/plugins/agents/Panel.qml), [installed guide](https://github.com/omacom/omarchy/blob/cce8b1c971df64a7610b818ff8819e4bea04584a/default/ag

    plugins/build-omarchy-plugins/skills/omarchy-plugin-design/references/integration-boundaries.md

    • Network accessline 20
      Evidence: [AppSignal](https://github.com/omacom/omarchy-plugin-marketplace/issues/7141#issuecomment-5722655664),
    • Network accessline 21
      [Chezmoi Hound](https://github.com/omacom/omarchy-plugin-marketplace/issues/7526#issuecomment-5746267624),
    • Network accessline 22
      [Jarvis](https://github.com/omacom/omarchy-plugin-marketplace/issues/5614#issuecomment-5734988047).
    • Network accessline 28
      broker is needed, substantiate the deployed-code and credential trust boundary; do not send bearer/refresh credentials to an unverified default shared service. See [Coinbase](https://github.com/omacom/omarchy-plugin-marketplace/issues/7520#
    • Network accessline 30
      See [Coinbase](https://github.com/omacom/omarchy-plugin-marketplace/issues/7520#issuecomment-5741977697).
    • Network accessline 41
      Evidence: [OmaNomad](https://github.com/omacom/omarchy-plugin-marketplace/issues/5371#issuecomment-5745040622),
    • Network accessline 42
      [signing-key bootstrap](https://github.com/omacom/omarchy-plugin-marketplace/issues/5402#issuecomment-5672481038).
    • Dangerous shell operationline 49
      name, or caller-selected askpass child of genuine sudo does not establish the
    • Network accessline 52
      not only an obviously forged identity. Keep fail-closed behavior when the trusted helper/identity is unavailable. See [Doorman follow-up](https://github.com/omacom/omarchy-plugin-marketplace/issues/9558#issuecomment-5961920299).
    • Network accessline 54
      [Doorman follow-up](https://github.com/omacom/omarchy-plugin-marketplace/issues/9558#issuecomment-5961920299).

    plugins/build-omarchy-plugins/skills/omarchy-plugin-design/references/kind-selection.md

    • Network accessline 66
      Authoritative sources: [Omarchy shell documentation](https://github.com/basecamp/omarchy/blob/quattro/docs/omarchy-shell.md)
    • Network accessline 67
      [Omarchy shell documentation](https://github.com/basecamp/omarchy/blob/quattro/docs/omarchy-shell.md)
    • Network accessline 68
      and [shell plugin manual](https://omarchy.org/manual/shell-plugins/).

    plugins/build-omarchy-plugins/skills/omarchy-plugin-migrate/SKILL.md

    • Dangerous shell operationline 12
      - `omarchy plugin add` clones/validates files and changes enabled state; it runs no installation hooks or sudo setup. Document explicit prerequisites or a separate package path.

    plugins/build-omarchy-plugins/skills/omarchy-plugin-publish/references/marketplace-submission.md

    • Network accessline 3
      Verified against [`omacom/omarchy-plugin-marketplace`](https://github.com/omacom/omarchy-plugin-marketplace)
    • Network accessline 4
      [`omacom/omarchy-plugin-marketplace`](https://github.com/omacom/omarchy-plugin-marketplace)
    • Network accessline 91
      These rules are pinned in the bundle's verification form and [verification workflow](https://github.com/omacom/omarchy-plugin-marketplace/blob/bdf7c4fd1c0cb2bc1175dc0931362727aa4a0cb3/VERIFICATION.md).
    • Network accessline 92
      [verification workflow](https://github.com/omacom/omarchy-plugin-marketplace/blob/bdf7c4fd1c0cb2bc1175dc0931362727aa4a0cb3/VERIFICATION.md).
    • Network accessline 101
      - [Malformed CLI intake](https://github.com/omacom/omarchy-plugin-marketplace/commit/1f845b73e7324ee0bde2f7c121032066aa9cc295):   malformed `[Plugin]:` requests now receive the submission label so their actual
    • Network accessline 103
      form-error report can publish. The label is not a successful validation. Fix   the existing body and retry; do not diagnose every intake error as plugin code. - [Migrated repositories](https://github.com/omacom/omarchy-plugin-marketplace/co
    • Network accessline 104
      the existing body and retry; do not diagnose every intake error as plugin code. - [Migrated repositories](https://github.com/omacom/omarchy-plugin-marketplace/commit/8be8e3be5fc0a0592cc90b9d37d858177a624a84):   verification/update requests
    • Network accessline 105
      - [Migrated repositories](https://github.com/omacom/omarchy-plugin-marketplace/commit/8be8e3be5fc0a0592cc90b9d37d858177a624a84):   verification/update requests may name a recorded former repository of their   own listing. The workflow resol
    • Network accessline 109
      Prefer the current registered canonical URL. Do not repurpose Verify for a new   listing or rewrite historical evidence to make a mismatch disappear. - [Refresh scheduling](https://github.com/omacom/omarchy-plugin-marketplace/commit/74836ff
    • Network accessline 110
      listing or rewrite historical evidence to make a mismatch disappear. - [Refresh scheduling](https://github.com/omacom/omarchy-plugin-marketplace/commit/74836ff40c4f55f04aafbb401e557deb0a770bd0):   unchanged previously passing sources can de
    • Network accessline 111
      - [Refresh scheduling](https://github.com/omacom/omarchy-plugin-marketplace/commit/74836ff40c4f55f04aafbb401e557deb0a770bd0):
    • Network accessline 120
      retain maintainer authority over classification; no local helper here sets the marketplace's manual override. Examples: [Pocket](https://github.com/omacom/omarchy-plugin-marketplace/issues/9872#issuecomment-5971720907),
    • Network accessline 121
      marketplace's manual override. Examples: [Pocket](https://github.com/omacom/omarchy-plugin-marketplace/issues/9872#issuecomment-5971720907), [OMeetingBar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9860#issuecomment-5970904
    • Network accessline 122
      [Pocket](https://github.com/omacom/omarchy-plugin-marketplace/issues/9872#issuecomment-5971720907),
    • Network accessline 123
      [OMeetingBar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9860#issuecomment-5970904348),
    • Network accessline 124
      [TMOS](https://github.com/omacom/omarchy-plugin-marketplace/issues/8574#issuecomment-5972030850).

    plugins/build-omarchy-plugins/skills/omarchy-plugin-publish/references/review-response.md

    • Network accessline 27
      not automatically equivalent. This concerns the desktop plugin being built, not this agent-skills bundle, whose intended payload is instructions. See [review #4744](https://github.com/omacom/omarchy-plugin-marketplace/issues/4744#issuecomme
    • Network accessline 29
      See [review #4744](https://github.com/omacom/omarchy-plugin-marketplace/issues/4744#issuecomment-5642689162).
    • Network accessline 38
      Checked 13 September 2026 against marketplace commit `55efec9646cc24ca3ae8c427440043fa745ada49` and the two bot reports on [Markets update #6586](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586).
    • Network accessline 39
      `55efec9646cc24ca3ae8c427440043fa745ada49` and the two bot reports on [Markets update #6586](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586). The [compatibility report](https://github.com/omacom/omarchy-plugin-marketplace/
    • Network accessline 40
      [Markets update #6586](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586).
    • Network accessline 41
      The [compatibility report](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586#issuecomment-5648889073) passed, while the [security report](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586#issuecomment-564889946
    • Network accessline 42
      passed, while the [security report](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586#issuecomment-5648899465) required privilege review solely for README prose: “This plugin never requests sudo, installs packages, starts a s
    • Dangerous shell operationline 53
      not arbitrary English: `No sudo or pkexec is required.` is a documented example;
    • Network accessline 69
      Prepare any response within the user's scope; send it only with authorization. The authoritative policy and limits are in the pinned [security policy](https://github.com/omacom/omarchy-plugin-marketplace/blob/bdf7c4fd1c0cb2bc1175dc093136272
    • Network accessline 71
      [security policy](https://github.com/omacom/omarchy-plugin-marketplace/blob/bdf7c4fd1c0cb2bc1175dc0931362727aa4a0cb3/SECURITY.md#automated-security-baseline).
    • Network accessline 80
      or SHA-shaped reference does not prove least privilege, provenance or complete pinning. Container jobs and transitive dependency resolution still need manual review. See [CI review](https://github.com/omacom/omarchy-plugin-marketplace/issue
    • Network accessline 82
      review. See [CI review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7491#issuecomment-5741754091).
    • Network accessline 86
      classifying ordinary documentation; keep development-only agent instructions outside the distributed desktop plugin. This is not a ban on intentional agent skill bundles. See [hook review](https://github.com/omacom/omarchy-plugin-marketplac
    • Network accessline 88
      skill bundles. See [hook review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7476#issuecomment-5746209569).
    • Network accessline 90
      A scanner may also match command strings inside a bundled validator's rules. [Kamal's baseline](https://github.com/omacom/omarchy-plugin-marketplace/issues/7656#issuecomment-5742922054)
    • Network accessline 91
      [Kamal's baseline](https://github.com/omacom/omarchy-plugin-marketplace/issues/7656#issuecomment-5742922054)
    • Network accessline 98
      [Workbench review](https://github.com/omacom/omarchy-plugin-marketplace/issues/3795#issuecomment-5784382912)
    • Network accessline 109
      forward. Track active, fixed, withdrawn and unverified separately. Hancore withdrew earlier allocation concerns as security listing blockers in [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-597059
    • Network accessline 110
      withdrew earlier allocation concerns as security listing blockers in [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-5970593063) and [OmaRead](https://github.com/omacom/omarchy-plugin-marketplace/is
    • Network accessline 111
      [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-5970593063)
    • Network accessline 112
      and [OmaRead](https://github.com/omacom/omarchy-plugin-marketplace/issues/9174#issuecomment-5970439231),
    • Network accessline 124
      For example, [Doorman](https://github.com/omacom/omarchy-plugin-marketplace/issues/9558#issuecomment-5952627749)

    plugins/build-omarchy-plugins/skills/omarchy-plugin-publish/references/submission-options.md

    • Network accessline 5
      Recommend [Omakit](https://github.com/mtolhuys/omakit) to run submission checks
    • Network accessline 6
      and prepare a reviewable draft with `omakit submit <plugin-repo>`. Consult its [current command documentation](https://github.com/mtolhuys/omakit/blob/main/docs/SUBMIT.md) and run against the intended committed candidate. Record the candida
    • Network accessline 7
      [current command documentation](https://github.com/mtolhuys/omakit/blob/main/docs/SUBMIT.md)

    plugins/build-omarchy-plugins/skills/omarchy-plugin-publish/scripts/prepare_submission.py

    • Executable scriptline 1
      #!/usr/bin/env python3
    • Network accessline 34
      ssh = re.fullmatch(r"git@github\.com:([^/]+)/(.+?)(?:\.git)?", value)     if ssh:         return f"https://github.com/{ssh.group(1)}/{ssh.group(2)}"
    • Network accessline 35
      if ssh:         return f"https://github.com/{ssh.group(1)}/{ssh.group(2)}"     if value.startswith("https://github.com/"):
    • Network accessline 36
      return f"https://github.com/{ssh.group(1)}/{ssh.group(2)}"
    • Network accessline 37
      if value.startswith("https://github.com/"):
    • Network accessline 76
      return 2     repository = (args.repository or git_repository(root)).removesuffix(".git").rstrip("/")     if not re.fullmatch(r"https://github\.com/[^/]+/[^/]+", repository):
    • Network accessline 77
      repository = (args.repository or git_repository(root)).removesuffix(".git").rstrip("/")     if not re.fullmatch(r"https://github\.com/[^/]+/[^/]+", repository):         print("prepare_submission.py: provide a GitHub repository root URL", fi
    • Network accessline 78
      if not re.fullmatch(r"https://github\.com/[^/]+/[^/]+", repository):

    plugins/build-omarchy-plugins/skills/omarchy-plugin-release/references/release-contract.md

    • Network accessline 46
      Apply these checks to the installation/build paths the plugin actually uses. Recent [Mynah review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7255#issuecomment-5745951194)
    • Network accessline 47
      Recent [Mynah review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7255#issuecomment-5745951194)
    • Network accessline 48
      and [MFA review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7491#issuecomment-5741754091),
    • Network accessline 64
      downloader default and minimum accepted backend version. Test a clean install,   upgrade from the affected version and a stale preinstalled/local executable.   [Bitwarden review](https://github.com/omacom/omarchy-plugin-marketplace/issues/3
    • Network accessline 65
      upgrade from the affected version and a stale preinstalled/local executable.   [Bitwarden review](https://github.com/omacom/omarchy-plugin-marketplace/issues/3098#issuecomment-5744992291)   found fixed source while the plugin still download
    • Network accessline 66
      [Bitwarden review](https://github.com/omacom/omarchy-plugin-marketplace/issues/3098#issuecomment-5744992291)
    • Network accessline 78
      must leave unrelated and user-modified files intact. Exercise fresh install, repeat install, conflicting target, modified managed file and removal cases. See [NetScope](https://github.com/omacom/omarchy-plugin-marketplace/issues/5619#issuec
    • Network accessline 79
      repeat install, conflicting target, modified managed file and removal cases. See [NetScope](https://github.com/omacom/omarchy-plugin-marketplace/issues/5619#issuecomment-5819540608) and [MoErgo](https://github.com/omacom/omarchy-plugin-mark
    • Network accessline 80
      See [NetScope](https://github.com/omacom/omarchy-plugin-marketplace/issues/5619#issuecomment-5819540608)
    • Network accessline 81
      and [MoErgo](https://github.com/omacom/omarchy-plugin-marketplace/issues/7107#issuecomment-5819566127).
    • Network accessline 85
      changes. Recheck the commit and complete loadable tree after checkout and before validation/rescan; account for ignored executable source too. Preserve that identity until loading. See [Plugin Updates](https://github.com/omacom/omarchy-plug
    • Network accessline 87
      identity until loading. See [Plugin Updates](https://github.com/omacom/omarchy-plugin-marketplace/issues/8250#issuecomment-5801511763).
    • Network accessline 92
      artifact digest to the expected repository, trusted workflow and full source SHA; an owner-only attestation check is too broad. Check before extraction/execution. See [toolchain](https://github.com/omacom/omarchy-plugin-marketplace/issues/7
    • Network accessline 93
      an owner-only attestation check is too broad. Check before extraction/execution. See [toolchain](https://github.com/omacom/omarchy-plugin-marketplace/issues/7631#issuecomment-5800962204) and [attestation identity](https://github.com/omacom/
    • Network accessline 94
      See [toolchain](https://github.com/omacom/omarchy-plugin-marketplace/issues/7631#issuecomment-5800962204)
    • Network accessline 95
      and [attestation identity](https://github.com/omacom/omarchy-plugin-marketplace/issues/7107#issuecomment-5792174978).
    • Network accessline 99
      UI does not authenticate the required backend. A checksum from the same movable tag as a root bootstrap supplies no independent trust. See [Omatalk](https://github.com/omacom/omarchy-plugin-marketplace/issues/8407#issuecomment-5818821005)
    • Network accessline 100
      tag as a root bootstrap supplies no independent trust. See [Omatalk](https://github.com/omacom/omarchy-plugin-marketplace/issues/8407#issuecomment-5818821005) and [OmaNitro](https://github.com/omacom/omarchy-plugin-marketplace/issues/5540#i
    • Network accessline 101
      [Omatalk](https://github.com/omacom/omarchy-plugin-marketplace/issues/8407#issuecomment-5818821005)
    • Network accessline 102
      and [OmaNitro](https://github.com/omacom/omarchy-plugin-marketplace/issues/5540#issuecomment-5819470495).

    plugins/build-omarchy-plugins/skills/omarchy-plugin-release/scripts/release_preflight.py

    • Executable scriptline 1
      #!/usr/bin/env python3
    • Network accessline 45
      match = re.fullmatch(r"git@github\.com:([^/]+)/(.+?)(?:\.git)?", value)     if match:         return f"https://github.com/{match.group(1)}/{match.group(2)}"
    • Network accessline 46
      if match:         return f"https://github.com/{match.group(1)}/{match.group(2)}"     if value.startswith("https://github.com/"):
    • Network accessline 47
      return f"https://github.com/{match.group(1)}/{match.group(2)}"
    • Network accessline 48
      if value.startswith("https://github.com/"):
    • Network accessline 226
      else:                 normalized = normalize_remote(remote.stdout)                 if not re.fullmatch(r"https://github\.com/[^/]+/[^/]+", normalized):
    • Network accessline 227
      normalized = normalize_remote(remote.stdout)                 if not re.fullmatch(r"https://github\.com/[^/]+/[^/]+", normalized):                     add("error", "origin-github", "Origin is not a GitHub repository root URL.", normalized)
    • Network accessline 228
      if not re.fullmatch(r"https://github\.com/[^/]+/[^/]+", normalized):

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/repository-template.lock.json

    • Network accessline 1
      {   "schemaVersion": 1,   "repository": "https://github.com/tcballard/omarchy-plugin-template",
    • Network accessline 2
      "schemaVersion": 1,   "repository": "https://github.com/tcballard/omarchy-plugin-template",   "commit": "f99681e69937d21c2d4414ac9f65a0fd01fea714",
    • Network accessline 3
      "repository": "https://github.com/tcballard/omarchy-plugin-template",

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/repository-template/.template/blueprint/AGENTS.md

    • Network accessline 5
      - Run ./tests/run. Follow docs/DEVELOPMENT.md for native checks. - Use [build-omarchy-plugins](https://github.com/tcballard/build-omarchy-plugins) guidance and verify current upstream contracts before relying on version-specific APIs.
    • Network accessline 6
      - Use [build-omarchy-plugins](https://github.com/tcballard/build-omarchy-plugins) guidance and verify current upstream contracts before relying on version-specific APIs.

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/repository-template/.template/blueprint/CREDITS.md

    • Network accessline 8
      - plugin conventions: [build-omarchy-plugins](https://github.com/tcballard/build-omarchy-plugins).
    • Network accessline 9
      - Community badge artwork: [omarchy-badges](https://github.com/tcballard/omarchy-badges), pinned to 75975e5b5bf75e7ede3764bcd2950046f7abfe2c. No badge artwork is bundled.

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/repository-template/.template/blueprint/README.md

    • Network accessline 5
      <p align="center"><a href="https://github.com/tcballard/omarchy-badges"><img alt="Built for Omarchy: Plugin" height="20" src="https://raw.githubusercontent.com/tcballard/omarchy-badges/75975e5b5bf75e7ede3764bcd2950046f7abfe2c/badges/v1/omar
    • Network accessline 32
      Built from [Build Omarchy Plugins](https://github.com/tcballard/build-omarchy-plugins) guidance and the Omarchy template set. [Sources, inspiration and assets](CREDITS.md).

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/repository-template/AGENTS.md

    • Network accessline 5
      - Run ./tests/run. Follow docs/DEVELOPMENT.md for native checks. - Use [build-omarchy-plugins](https://github.com/tcballard/build-omarchy-plugins) guidance and verify current upstream contracts before relying on version-specific APIs.
    • Network accessline 6
      - Use [build-omarchy-plugins](https://github.com/tcballard/build-omarchy-plugins) guidance and verify current upstream contracts before relying on version-specific APIs.

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/repository-template/CREDITS.md

    • Network accessline 8
      - plugin conventions: [build-omarchy-plugins](https://github.com/tcballard/build-omarchy-plugins).
    • Network accessline 9
      - Community badge artwork: [omarchy-badges](https://github.com/tcballard/omarchy-badges), pinned to 75975e5b5bf75e7ede3764bcd2950046f7abfe2c. No badge artwork is bundled.

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/repository-template/README.md

    • Network accessline 5
      <p align="center"><a href="https://github.com/tcballard/omarchy-badges"><img alt="Built for Omarchy: Plugin" height="20" src="https://raw.githubusercontent.com/tcballard/omarchy-badges/75975e5b5bf75e7ede3764bcd2950046f7abfe2c/badges/v1/omar
    • Network accessline 32
      Built from [Build Omarchy Plugins](https://github.com/tcballard/build-omarchy-plugins) guidance and the Omarchy template set. [Sources, inspiration and assets](CREDITS.md).

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/repository-template/scripts/archive.mjs

    • Executable scriptline 1
      #!/usr/bin/env node

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/repository-template/scripts/check.mjs

    • Executable scriptline 1
      #!/usr/bin/env node

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/repository-template/scripts/github.mjs

    • Executable scriptline 1
      #!/usr/bin/env node

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/repository-template/scripts/init.mjs

    • Executable scriptline 1
      #!/usr/bin/env node
    • Network accessline 7
      const input = process.argv.slice(2);   if (input.includes('--help')) {     console.log('node scripts/init.mjs --owner OWNER --repo REPO --slug SLUG --name "Project name" --author "Author" [--id io.github.owner.slug] [--description "Purpose"
    • Network accessline 8
      if (input.includes('--help')) {     console.log('node scripts/init.mjs --owner OWNER --repo REPO --slug SLUG --name "Project name" --author "Author" [--id io.github.owner.slug] [--description "Purpose"] [--inspiration https://...] [--year 2
    • Network accessline 9
      console.log('node scripts/init.mjs --owner OWNER --repo REPO --slug SLUG --name "Project name" --author "Author" [--id io.github.owner.slug] [--description "Purpose"] [--inspiration https://...] [--year 2026]');

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/repository-template/scripts/template.mjs

    • Executable scriptline 1
      Executable file
    • Network accessline 41
      values[key.toUpperCase() + '_DESKTOP'] = String(value).replaceAll('\\','\\\\');   }   values.REPO_URL = `https://github.com/${c.owner}/${c.repo}`;
    • Network accessline 42
      }   values.REPO_URL = `https://github.com/${c.owner}/${c.repo}`;   values.CRATE = c.slug.replaceAll('-', '_');
    • Network accessline 43
      values.REPO_URL = `https://github.com/${c.owner}/${c.repo}`;

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/repository-template/tests/run

    • Executable scriptline 1
      #!/usr/bin/env bash

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/repository-template/tests/template.test.mjs

    • Executable scriptline 1
      Executable file
    • Network accessline 10
      test('identity input rejects paths, reserved IDs and multiline values',()=>{   const c=readJSON(path.join(root,'.template/project.json'));   for(const patch of [{slug:'../../x'},{owner:'-flag'},{id:'omarchy.foo.bar'},{name:'x\ny'},{repo:'..
    • Network accessline 11
      const c=readJSON(path.join(root,'.template/project.json'));   for(const patch of [{slug:'../../x'},{owner:'-flag'},{id:'omarchy.foo.bar'},{name:'x\ny'},{repo:'../other'},{inspiration:'https://user:pass@example.com'}]) assert.throws(()=>vali
    • Network accessline 12
      for(const patch of [{slug:'../../x'},{owner:'-flag'},{id:'omarchy.foo.bar'},{name:'x\ny'},{repo:'../other'},{inspiration:'https://user:pass@example.com'}]) assert.throws(()=>validate({...c,...patch}));

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/templates/README.md.tpl

    • Network accessline 3
      [![Built for Omarchy: Plugin](https://raw.githubusercontent.com/tcballard/omarchy-badges/75975e5b5bf75e7ede3764bcd2950046f7abfe2c/badges/v1/omarchy-plugin.svg)](https://github.com/tcballard/omarchy-badges)

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/templates/demo-run.tpl

    • Executable scriptline 1
      #!/usr/bin/env bash

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/templates/preview.svg.tpl

    • Network accessline 1
      <svg xmlns="http://www.w3.org/2000/svg" width="1280" height="720" viewBox="0 0 1280 720">

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/templates/tests-run.tpl

    • Executable scriptline 1
      #!/usr/bin/env bash

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/assets/templates/validate_manifest.py.tpl

    • Executable scriptline 1
      #!/usr/bin/env python3

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/references/generated-layout.md

    • Network accessline 68
      Pair the [community badge](https://github.com/tcballard/omarchy-badges) with
    • Network accessline 128
      <p>   <a href="https://github.com/tcballard/omarchy-badges"><img alt="Built for Omarchy: Plugin" height="20" src="https://raw.githubusercontent.com/tcballard/omarchy-badges/75975e5b5bf75e7ede3764bcd2950046f7abfe2c/badges/v1/omarchy-plugin.s
    • Network accessline 129
      <a href="https://github.com/tcballard/omarchy-badges"><img alt="Built for Omarchy: Plugin" height="20" src="https://raw.githubusercontent.com/tcballard/omarchy-badges/75975e5b5bf75e7ede3764bcd2950046f7abfe2c/badges/v1/omarchy-plugin.svg"></
    • Network accessline 130
      <a href="#compatibility"><img alt="Supported Omarchy versions: 4.0.0+" height="20" src="https://raw.githubusercontent.com/tcballard/omarchy-badges/dd84bb21f19caf617caa5b3c1af7ff3c6cb847c3/badges/v1/compatibility/omarchy-4.0.0-plus.svg"></a>
    • Network accessline 135
      actual workflow and licence. Add the destination Compatibility heading and its support/test notes before publishing the example. Choose the appropriate [compatibility preset](https://github.com/tcballard/omarchy-badges/blob/7e00b3342bddefab
    • Network accessline 136
      support/test notes before publishing the example. Choose the appropriate [compatibility preset](https://github.com/tcballard/omarchy-badges/blob/7e00b3342bddefab7fece63f4806e47f4b77bf7c/COMPATIBILITY.md) without changing an existing pinned
    • Network accessline 137
      [compatibility preset](https://github.com/tcballard/omarchy-badges/blob/7e00b3342bddefab7fece63f4806e47f4b77bf7c/COMPATIBILITY.md)

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/references/repository-template.md

    • Network accessline 24
      The ID is permanent once published. Set it explicitly; the default derives it from the owner and slug. Optional `--inspiration https://...` adds prominent
    • Network accessline 25
      from the owner and slug. Optional `--inspiration https://...` adds prominent

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/scripts/new_plugin.py

    • Executable scriptline 1
      #!/usr/bin/env python3
    • Network accessline 111
      parts = plugin_id.split(".")     if len(parts) >= 4 and parts[0:2] == ["io", "github"]:         return f"https://github.com/{parts[2]}/{output_name}"
    • Network accessline 112
      if len(parts) >= 4 and parts[0:2] == ["io", "github"]:         return f"https://github.com/{parts[2]}/{output_name}"     return "https://github.com/OWNER/REPOSITORY"
    • Network accessline 113
      return f"https://github.com/{parts[2]}/{output_name}"
    • Network accessline 114
      return "https://github.com/OWNER/REPOSITORY"

    plugins/build-omarchy-plugins/skills/omarchy-plugin-scaffold/scripts/new_repository.mjs

    • Executable scriptline 1
      #!/usr/bin/env node
    • Network accessline 13
      const usage = `node "<skill-dir>/scripts/new_repository.mjs" --output /absolute/unused/path   --owner OWNER --repo REPO --slug SLUG --name "Plugin Name" --author "Author"   [--id io.github.owner.slug] [--description "Purpose"] [--inspiratio
    • Network accessline 14
      --owner OWNER --repo REPO --slug SLUG --name "Plugin Name" --author "Author"   [--id io.github.owner.slug] [--description "Purpose"] [--inspiration https://...]   [--year 2026]
    • Network accessline 15
      [--id io.github.owner.slug] [--description "Purpose"] [--inspiration https://...]

    plugins/build-omarchy-plugins/skills/omarchy-plugin-test/references/plain-text.md

    • Network accessline 28
      Checked 30 October 2026: [Bluetooth names](https://github.com/omacom/omarchy-plugin-marketplace/issues/13257#issuecomment-6503501447),
    • Network accessline 29
      [stored account names](https://github.com/omacom/omarchy-plugin-marketplace/issues/13302#issuecomment-6508507122),
    • Network accessline 30
      [Qt ToolTip](https://doc.qt.io/qt-6/qml-qtquick-controls-tooltip.html).

    plugins/build-omarchy-plugins/skills/omarchy-plugin-test/references/qml-testing.md

    • Network accessline 26
      The maintained [Basecamp Omarchy plugin](https://github.com/basecamp/omarchy-basecamp-plugin)
    • Network accessline 27
      [Basecamp Omarchy plugin](https://github.com/basecamp/omarchy-basecamp-plugin)

    plugins/build-omarchy-plugins/skills/omarchy-plugin-test/references/review-response.md

    • Network accessline 27
      not automatically equivalent. This concerns the desktop plugin being built, not this agent-skills bundle, whose intended payload is instructions. See [review #4744](https://github.com/omacom/omarchy-plugin-marketplace/issues/4744#issuecomme
    • Network accessline 29
      See [review #4744](https://github.com/omacom/omarchy-plugin-marketplace/issues/4744#issuecomment-5642689162).
    • Network accessline 38
      Checked 13 September 2026 against marketplace commit `55efec9646cc24ca3ae8c427440043fa745ada49` and the two bot reports on [Markets update #6586](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586).
    • Network accessline 39
      `55efec9646cc24ca3ae8c427440043fa745ada49` and the two bot reports on [Markets update #6586](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586). The [compatibility report](https://github.com/omacom/omarchy-plugin-marketplace/
    • Network accessline 40
      [Markets update #6586](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586).
    • Network accessline 41
      The [compatibility report](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586#issuecomment-5648889073) passed, while the [security report](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586#issuecomment-564889946
    • Network accessline 42
      passed, while the [security report](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586#issuecomment-5648899465) required privilege review solely for README prose: “This plugin never requests sudo, installs packages, starts a s
    • Dangerous shell operationline 53
      not arbitrary English: `No sudo or pkexec is required.` is a documented example;
    • Network accessline 69
      Prepare any response within the user's scope; send it only with authorization. The authoritative policy and limits are in the pinned [security policy](https://github.com/omacom/omarchy-plugin-marketplace/blob/bdf7c4fd1c0cb2bc1175dc093136272
    • Network accessline 71
      [security policy](https://github.com/omacom/omarchy-plugin-marketplace/blob/bdf7c4fd1c0cb2bc1175dc0931362727aa4a0cb3/SECURITY.md#automated-security-baseline).
    • Network accessline 80
      or SHA-shaped reference does not prove least privilege, provenance or complete pinning. Container jobs and transitive dependency resolution still need manual review. See [CI review](https://github.com/omacom/omarchy-plugin-marketplace/issue
    • Network accessline 82
      review. See [CI review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7491#issuecomment-5741754091).
    • Network accessline 86
      classifying ordinary documentation; keep development-only agent instructions outside the distributed desktop plugin. This is not a ban on intentional agent skill bundles. See [hook review](https://github.com/omacom/omarchy-plugin-marketplac
    • Network accessline 88
      skill bundles. See [hook review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7476#issuecomment-5746209569).
    • Network accessline 90
      A scanner may also match command strings inside a bundled validator's rules. [Kamal's baseline](https://github.com/omacom/omarchy-plugin-marketplace/issues/7656#issuecomment-5742922054)
    • Network accessline 91
      [Kamal's baseline](https://github.com/omacom/omarchy-plugin-marketplace/issues/7656#issuecomment-5742922054)
    • Network accessline 98
      [Workbench review](https://github.com/omacom/omarchy-plugin-marketplace/issues/3795#issuecomment-5784382912)
    • Network accessline 109
      forward. Track active, fixed, withdrawn and unverified separately. Hancore withdrew earlier allocation concerns as security listing blockers in [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-597059
    • Network accessline 110
      withdrew earlier allocation concerns as security listing blockers in [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-5970593063) and [OmaRead](https://github.com/omacom/omarchy-plugin-marketplace/is
    • Network accessline 111
      [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-5970593063)
    • Network accessline 112
      and [OmaRead](https://github.com/omacom/omarchy-plugin-marketplace/issues/9174#issuecomment-5970439231),
    • Network accessline 124
      For example, [Doorman](https://github.com/omacom/omarchy-plugin-marketplace/issues/9558#issuecomment-5952627749)

    plugins/build-omarchy-plugins/skills/omarchy-plugin-test/references/test-matrix.md

    • Network accessline 58
      Choose cases for the implemented boundary; these are not automatic results of static validation or mandatory work for unrelated edits. Guidance checked against [recent marketplace review](https://github.com/omacom/omarchy-plugin-marketplace
    • Network accessline 59
      static validation or mandatory work for unrelated edits. Guidance checked against [recent marketplace review](https://github.com/omacom/omarchy-plugin-marketplace/issues/3098#issuecomment-5744992291) on 20 September 2026:
    • Network accessline 60
      [recent marketplace review](https://github.com/omacom/omarchy-plugin-marketplace/issues/3098#issuecomment-5744992291)
    • Network accessline 114
      - Restore: malicious plugin ID or checkout reference cannot target a sibling   repository; backup-supplied symlinks cannot redirect writes. - Display: `<img src="https://example.invalid/pixel">` remains literal through
    • Network accessline 115
      repository; backup-supplied symlinks cannot redirect writes. - Display: `<img src="https://example.invalid/pixel">` remains literal through   compact, expanded and shared controls. Static textFormat checks alone do not
    • Network accessline 116
      - Display: `<img src="https://example.invalid/pixel">` remains literal through

    plugins/build-omarchy-plugins/skills/omarchy-plugin-test/references/upgrade-fixtures.md

    • Network accessline 15
      Checked 30 October 2026: [legacy cache](https://github.com/omacom/omarchy-plugin-marketplace/issues/13257#issuecomment-6502311163),
    • Network accessline 16
      [saved Wi-Fi profile](https://github.com/omacom/omarchy-plugin-marketplace/issues/13283#issuecomment-6513914836),
    • Network accessline 17
      [managed listener](https://github.com/omacom/omarchy-plugin-marketplace/issues/13323#issuecomment-6513057859).

    plugins/build-omarchy-plugins/skills/omarchy-plugin-test/references/validation-options.md

    • Network accessline 22
      The settings check accepts `multiselect`, including object-valued options as used by Quattro's [Indicators manifest](https://github.com/omacom/omarchy/blob/947e2fc002d6831c7888b29b5761d59d29e69727/shell/plugins/bar/widgets/Indicators.manife
    • Network accessline 23
      used by Quattro's [Indicators manifest](https://github.com/omacom/omarchy/blob/947e2fc002d6831c7888b29b5761d59d29e69727/shell/plugins/bar/widgets/Indicators.manifest.json)
    • Network accessline 56
      Recommend [Omakit](https://github.com/mtolhuys/omakit) as an optional companion
    • Network accessline 74
      For a security review, recommend consulting the community [Omarchy plugin security skill](https://github.com/wbso-ai/omarchy-plugin-security-skill).
    • Network accessline 75
      [Omarchy plugin security skill](https://github.com/wbso-ai/omarchy-plugin-security-skill).
    • Network accessline 80
      For GUI and lifecycle checks on a disposable desktop, consider [OmaVM](https://github.com/mlclifton/omavm), which documents QEMU/KVM guests and
    • Network accessline 81
      [OmaVM](https://github.com/mlclifton/omavm), which documents QEMU/KVM guests and
    • Network accessline 89
      For checks on a separate Omarchy computer you already own and have paired, [ibara](https://ibara.app/docs/agents) exposes its desktop to an MCP agent.
    • Network accessline 90
      [ibara](https://ibara.app/docs/agents) exposes its desktop to an MCP agent.
    • Network accessline 97
      This is an optional remote-hardware route, not a disposable desktop or sandbox; missing pairing/access leaves those checks unrun. See the [first-task guide](https://ibara.app/docs/first-task) for setup and a practice task.
    • Network accessline 98
      missing pairing/access leaves those checks unrun. See the [first-task guide](https://ibara.app/docs/first-task) for setup and a practice task. The ibara references were checked on 20 October 2026; do not install or pair a
    • Network accessline 99
      [first-task guide](https://ibara.app/docs/first-task) for setup and a practice task.

    plugins/build-omarchy-plugins/skills/omarchy-plugin-test/scripts/check_plain_text.py

    • Executable scriptline 1
      #!/usr/bin/env python3

    plugins/build-omarchy-plugins/skills/omarchy-plugin-test/scripts/validate_plugin.py

    • Executable scriptline 1
      #!/usr/bin/env python3
    • Possible obfuscationline 521
      b"\xfe\xed\xfa\xce", b"\xfe\xed\xfa\xcf", b"\xce\xfa\xed\xfe", b"\xcf\xfa\xed\xfe",

    plugins/build-omarchy-plugins/skills/omarchy-qml-patterns/references/hosted-qml.md

    • Network accessline 79
      Authoritative contract: [docs/omarchy-shell.md](https://github.com/omacom/omarchy/blob/cce8b1c971df64a7610b818ff8819e4bea04584a/docs/omarchy-shell.md).
    • Network accessline 80
      [docs/omarchy-shell.md](https://github.com/omacom/omarchy/blob/cce8b1c971df64a7610b818ff8819e4bea04584a/docs/omarchy-shell.md).

    plugins/build-omarchy-plugins/skills/omarchy-qml-patterns/references/reviewer-boundaries.md

    • Network accessline 3
      Derived from HANCORE-linux's public reviews in [omacom/omarchy-plugin-marketplace](https://github.com/omacom/omarchy-plugin-marketplace/issues),
    • Network accessline 4
      [omacom/omarchy-plugin-marketplace](https://github.com/omacom/omarchy-plugin-marketplace/issues),
    • Network accessline 28
      shared controls too; formatting one parent does not secure every child sink. Keep intentional rich text fixed or generated from explicitly trusted content. See [review #3360](https://github.com/omacom/omarchy-plugin-marketplace/issues/3360#
    • Network accessline 30
      See [review #3360](https://github.com/omacom/omarchy-plugin-marketplace/issues/3360#issuecomment-5464817134).
    • Network accessline 37
      can otherwise keep a request alive. Test overflow, an unterminated line, stalled input and oversized error output on the actual production read path. See [review #1667](https://github.com/omacom/omarchy-plugin-marketplace/issues/1667#issuec
    • Network accessline 39
      See [review #1667](https://github.com/omacom/omarchy-plugin-marketplace/issues/1667#issuecomment-5451236689).
    • Network accessline 46
      interpreter too; Python isolation may be needed where inherited search paths could load code. Do not apply these Linux runtime choices to unrelated portable builder scripts. See [review #6292](https://github.com/omacom/omarchy-plugin-market
    • Network accessline 48
      builder scripts. See [review #6292](https://github.com/omacom/omarchy-plugin-marketplace/issues/6292#issuecomment-5645360550).
    • Network accessline 60
      stubborn child, child descendants, cancellation and late completion. Rate-limit public IPC, serialize state changes and bound restart/backoff attempts. See [review #6157](https://github.com/omacom/omarchy-plugin-marketplace/issues/6157#issu
    • Network accessline 62
      See [review #6157](https://github.com/omacom/omarchy-plugin-marketplace/issues/6157#issuecomment-5647018532).
    • Network accessline 71
      relative to the retained parent. When sharing state with another writer, check its revision before replacement; an unrelated plugin lock is insufficient. See [review #6426](https://github.com/omacom/omarchy-plugin-marketplace/issues/6426#is
    • Network accessline 73
      See [review #6426](https://github.com/omacom/omarchy-plugin-marketplace/issues/6426#issuecomment-5646894185).
    • Network accessline 80
      state. If a CLI cannot accept secrets safely, design the plugin around an already-configured account. Disclosure alone does not fix exposure. See [review #2766](https://github.com/omacom/omarchy-plugin-marketplace/issues/2766#issuecomment-5
    • Network accessline 82
      See [review #2766](https://github.com/omacom/omarchy-plugin-marketplace/issues/2766#issuecomment-5446596212).
    • Network accessline 94
      validated local artifact. If the required decoder is absent, fail closed instead of passing unvalidated bytes through. Declare the validating dependency. See [artwork review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7180#
    • Network accessline 96
      See [artwork review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7180#issuecomment-5735649258).
    • Network accessline 101
      constraints, and clean up partials on overflow/cancellation. Test many individually valid inputs as well as a single oversized input. See [stream accumulation](https://github.com/omacom/omarchy-plugin-marketplace/issues/7047#issuecomment-57
    • Network accessline 102
      valid inputs as well as a single oversized input. See [stream accumulation](https://github.com/omacom/omarchy-plugin-marketplace/issues/7047#issuecomment-5735500611) and [transfer budgets](https://github.com/omacom/omarchy-plugin-marketplac
    • Network accessline 103
      See [stream accumulation](https://github.com/omacom/omarchy-plugin-marketplace/issues/7047#issuecomment-5735500611)
    • Network accessline 104
      and [transfer budgets](https://github.com/omacom/omarchy-plugin-marketplace/issues/6068#issuecomment-5735045519).
    • Network accessline 112
      signing key from that checkout retain the same problem. Authenticate final package bytes through installation, not just downloaded source. See [bootstrap re-review](https://github.com/omacom/omarchy-plugin-marketplace/issues/5371#issuecomme
    • Network accessline 114
      See [bootstrap re-review](https://github.com/omacom/omarchy-plugin-marketplace/issues/5371#issuecomment-5745040622).
    • Network accessline 124
      loopback literal. Handle redirects and resolved destinations under the same policy. Remote use requires the agreed explicit opt-in. See [local API review](https://github.com/omacom/omarchy-plugin-marketplace/issues/8352#issuecomment-5819807
    • Network accessline 125
      policy. Remote use requires the agreed explicit opt-in. See [local API review](https://github.com/omacom/omarchy-plugin-marketplace/issues/8352#issuecomment-5819807404) and [local-only leak](https://github.com/omacom/omarchy-plugin-marketpl
    • Network accessline 126
      See [local API review](https://github.com/omacom/omarchy-plugin-marketplace/issues/8352#issuecomment-5819807404) and [local-only leak](https://github.com/omacom/omarchy-plugin-marketplace/issues/8434#issuecomment-5819147536), checked 24 Sep
    • Network accessline 127
      and [local-only leak](https://github.com/omacom/omarchy-plugin-marketplace/issues/8434#issuecomment-5819147536), checked 24 September 2026. Test allowed clients, unauthenticated requests, hostile Host/Origin values and deceptive endpoint na
    • Network accessline 137
      close responses on every exit and join/reap readers within a bounded wait. Repeat cancellation with a full queue to expose retained threads and resources. See [slow reads](https://github.com/omacom/omarchy-plugin-marketplace/issues/8371#iss
    • Network accessline 138
      Repeat cancellation with a full queue to expose retained threads and resources. See [slow reads](https://github.com/omacom/omarchy-plugin-marketplace/issues/8371#issuecomment-5819019831), [git children](https://github.com/omacom/omarchy-plu
    • Network accessline 139
      See [slow reads](https://github.com/omacom/omarchy-plugin-marketplace/issues/8371#issuecomment-5819019831),
    • Network accessline 140
      [git children](https://github.com/omacom/omarchy-plugin-marketplace/issues/8392#issuecomment-5819774887)
    • Network accessline 141
      and [queue shutdown](https://github.com/omacom/omarchy-plugin-marketplace/issues/5619#issuecomment-5784771145).
    • Network accessline 145
      a pathname check followed by numeric-PID signaling can race. Prefer a suitable user service/cgroup or a race-free process handle and avoid elevating user-process cleanup. See [DevWatch](https://github.com/omacom/omarchy-plugin-marketplace/i
    • Network accessline 146
      user service/cgroup or a race-free process handle and avoid elevating user-process cleanup. See [DevWatch](https://github.com/omacom/omarchy-plugin-marketplace/issues/7927#issuecomment-5815441990) and [Phonecam](https://github.com/omacom/om
    • Network accessline 147
      cleanup. See [DevWatch](https://github.com/omacom/omarchy-plugin-marketplace/issues/7927#issuecomment-5815441990)
    • Network accessline 148
      and [Phonecam](https://github.com/omacom/omarchy-plugin-marketplace/issues/7497#issuecomment-5795173133).
    • Network accessline 156
      external Text sink to PlainText. Verify every visible button and IPC invocation uses the actual manifest ID, especially after a rename. See [Clipbar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8478#issuecomment-5819340291),
    • Network accessline 157
      uses the actual manifest ID, especially after a rename. See [Clipbar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8478#issuecomment-5819340291), [persisted location](https://github.com/omacom/omarchy-plugin-marketplace/issue
    • Network accessline 158
      See [Clipbar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8478#issuecomment-5819340291),
    • Network accessline 159
      [persisted location](https://github.com/omacom/omarchy-plugin-marketplace/issues/8395#issuecomment-5819055337)
    • Network accessline 160
      and [panel target](https://github.com/omacom/omarchy-plugin-marketplace/issues/8463#issuecomment-5819309888).
    • Network accessline 164
      Read current reviewer disposition before calling a concern a listing blocker. [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-5970593063)
    • Network accessline 165
      [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-5970593063)
    • Network accessline 166
      and [OmaRead](https://github.com/omacom/omarchy-plugin-marketplace/issues/9174#issuecomment-5970439231)
    • Network accessline 173
      apply the policy to redirects and proxy routing too. For credential-bearing requests, prefer refusing redirects; never forward secrets to a new origin. See [Sift](https://github.com/omacom/omarchy-plugin-marketplace/issues/9858#issuecomment
    • Network accessline 174
      requests, prefer refusing redirects; never forward secrets to a new origin. See [Sift](https://github.com/omacom/omarchy-plugin-marketplace/issues/9858#issuecomment-5970803404) and [TMOS](https://github.com/omacom/omarchy-plugin-marketplace
    • Network accessline 175
      See [Sift](https://github.com/omacom/omarchy-plugin-marketplace/issues/9858#issuecomment-5970803404)
    • Network accessline 176
      and [TMOS](https://github.com/omacom/omarchy-plugin-marketplace/issues/8574#issuecomment-5823505773).
    • Network accessline 180
      state in the backend immediately before forwarding input; a masked UI field or polled password-prompt state cannot protect secrets in argv/scrollback. See [Pianobar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8898#issuecomm
    • Network accessline 181
      or polled password-prompt state cannot protect secrets in argv/scrollback. See [Pianobar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8898#issuecomment-5855383375) and its [stale prompt check](https://github.com/omacom/omarc
    • Network accessline 182
      See [Pianobar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8898#issuecomment-5855383375)
    • Network accessline 183
      and its [stale prompt check](https://github.com/omacom/omarchy-plugin-marketplace/issues/8898#issuecomment-5858550108).
    • Network accessline 187
      operation, trusted helper and secret recipient to the same verified flow; names, caller-supplied command text and an arbitrary child of real sudo are insufficient. See [Doorman](https://github.com/omacom/omarchy-plugin-marketplace/issues/95
    • Dangerous shell operationline 188
      caller-supplied command text and an arbitrary child of real sudo are insufficient.
    • Network accessline 188
      caller-supplied command text and an arbitrary child of real sudo are insufficient. See [Doorman](https://github.com/omacom/omarchy-plugin-marketplace/issues/9558#issuecomment-5961920299). Loopback alone also does not isolate private history
    • Network accessline 189
      See [Doorman](https://github.com/omacom/omarchy-plugin-marketplace/issues/9558#issuecomment-5961920299). Loopback alone also does not isolate private history from other local accounts; authenticate those reads or use a suitably protected Un
    • Network accessline 190
      Loopback alone also does not isolate private history from other local accounts; authenticate those reads or use a suitably protected Unix socket. See [Umbra](https://github.com/omacom/omarchy-plugin-marketplace/issues/8928#issuecomment-5928
    • Network accessline 192
      See [Umbra](https://github.com/omacom/omarchy-plugin-marketplace/issues/8928#issuecomment-5928250307).
    • Network accessline 195
      or invoking Git; reject backup-supplied symlinks before writes. A restore must stay within the authorized plugin set. See [Settings Sync](https://github.com/omacom/omarchy-plugin-marketplace/issues/9849#issuecomment-5970334443).
    • Network accessline 196
      stay within the authorized plugin set. See [Settings Sync](https://github.com/omacom/omarchy-plugin-marketplace/issues/9849#issuecomment-5970334443). Ensure success describes the full promised state across all active providers;
    • Network accessline 197
      [Settings Sync](https://github.com/omacom/omarchy-plugin-marketplace/issues/9849#issuecomment-5970334443).
    • Network accessline 198
      Ensure success describes the full promised state across all active providers; checking only resolved cannot establish discovery is disabled if Avahi still publishes. See [Network Persona](https://github.com/omacom/omarchy-plugin-marketplace
    • Network accessline 200
      publishes. See [Network Persona](https://github.com/omacom/omarchy-plugin-marketplace/issues/9854#issuecomment-5970652519).

    plugins/build-omarchy-plugins/skills/omarchy-qml-patterns/references/translations.md

    • Network accessline 39
      Sources: [plugin guide](https://github.com/omacom/omarchy/blob/cce8b1c971df64a7610b818ff8819e4bea04584a/default/agents/skills/omarchy/plugins.md), [Translations.qml](https://github.com/omacom/omarchy/blob/cce8b1c971df64a7610b818ff8819e4bea0

    plugins/build-omarchy-plugins/skills/omarchy-service-ipc/assets/private-request/read_request.py

    • Executable scriptline 1
      Executable file

    plugins/build-omarchy-plugins/skills/omarchy-service-ipc/references/private-content.md

    • Network accessline 35
      Checked 30 October 2026: [ArchyWidgets](https://github.com/omacom/omarchy-plugin-marketplace/issues/13129#issuecomment-6474345255),
    • Network accessline 36
      [Omail's downstream filename leak](https://github.com/omacom/omarchy-plugin-marketplace/issues/13269#issuecomment-6504607813),
    • Network accessline 37
      [Quickshell Process](https://quickshell.org/docs/v0.2.1/types/Quickshell.Io/Process/).

    plugins/build-omarchy-plugins/skills/omarchy-service-ipc/references/process-safety.md

    • Network accessline 39
      A read-only bind of the whole filesystem still exposes secrets; allowlist only required inputs and CLI state, and fail closed when isolation is unavailable. See [Chezmoi Hound](https://github.com/omacom/omarchy-plugin-marketplace/issues/752
    • Network accessline 41
      See [Chezmoi Hound](https://github.com/omacom/omarchy-plugin-marketplace/issues/7526#issuecomment-5746267624).
    • Network accessline 43
      Repository source cannot attest a live OAuth broker deployment. Use local or user-controlled authentication, or substantiate the deployed credential boundary before routing tokens through a shared service. See [Coinbase](https://github.com/
    • Network accessline 45
      before routing tokens through a shared service. See [Coinbase](https://github.com/omacom/omarchy-plugin-marketplace/issues/7520#issuecomment-5741977697).

    plugins/build-omarchy-plugins/skills/omarchy-service-ipc/references/reviewer-boundaries.md

    • Network accessline 3
      Derived from HANCORE-linux's public reviews in [omacom/omarchy-plugin-marketplace](https://github.com/omacom/omarchy-plugin-marketplace/issues),
    • Network accessline 4
      [omacom/omarchy-plugin-marketplace](https://github.com/omacom/omarchy-plugin-marketplace/issues),
    • Network accessline 28
      shared controls too; formatting one parent does not secure every child sink. Keep intentional rich text fixed or generated from explicitly trusted content. See [review #3360](https://github.com/omacom/omarchy-plugin-marketplace/issues/3360#
    • Network accessline 30
      See [review #3360](https://github.com/omacom/omarchy-plugin-marketplace/issues/3360#issuecomment-5464817134).
    • Network accessline 37
      can otherwise keep a request alive. Test overflow, an unterminated line, stalled input and oversized error output on the actual production read path. See [review #1667](https://github.com/omacom/omarchy-plugin-marketplace/issues/1667#issuec
    • Network accessline 39
      See [review #1667](https://github.com/omacom/omarchy-plugin-marketplace/issues/1667#issuecomment-5451236689).
    • Network accessline 46
      interpreter too; Python isolation may be needed where inherited search paths could load code. Do not apply these Linux runtime choices to unrelated portable builder scripts. See [review #6292](https://github.com/omacom/omarchy-plugin-market
    • Network accessline 48
      builder scripts. See [review #6292](https://github.com/omacom/omarchy-plugin-marketplace/issues/6292#issuecomment-5645360550).
    • Network accessline 60
      stubborn child, child descendants, cancellation and late completion. Rate-limit public IPC, serialize state changes and bound restart/backoff attempts. See [review #6157](https://github.com/omacom/omarchy-plugin-marketplace/issues/6157#issu
    • Network accessline 62
      See [review #6157](https://github.com/omacom/omarchy-plugin-marketplace/issues/6157#issuecomment-5647018532).
    • Network accessline 71
      relative to the retained parent. When sharing state with another writer, check its revision before replacement; an unrelated plugin lock is insufficient. See [review #6426](https://github.com/omacom/omarchy-plugin-marketplace/issues/6426#is
    • Network accessline 73
      See [review #6426](https://github.com/omacom/omarchy-plugin-marketplace/issues/6426#issuecomment-5646894185).
    • Network accessline 80
      state. If a CLI cannot accept secrets safely, design the plugin around an already-configured account. Disclosure alone does not fix exposure. See [review #2766](https://github.com/omacom/omarchy-plugin-marketplace/issues/2766#issuecomment-5
    • Network accessline 82
      See [review #2766](https://github.com/omacom/omarchy-plugin-marketplace/issues/2766#issuecomment-5446596212).
    • Network accessline 94
      validated local artifact. If the required decoder is absent, fail closed instead of passing unvalidated bytes through. Declare the validating dependency. See [artwork review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7180#
    • Network accessline 96
      See [artwork review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7180#issuecomment-5735649258).
    • Network accessline 101
      constraints, and clean up partials on overflow/cancellation. Test many individually valid inputs as well as a single oversized input. See [stream accumulation](https://github.com/omacom/omarchy-plugin-marketplace/issues/7047#issuecomment-57
    • Network accessline 102
      valid inputs as well as a single oversized input. See [stream accumulation](https://github.com/omacom/omarchy-plugin-marketplace/issues/7047#issuecomment-5735500611) and [transfer budgets](https://github.com/omacom/omarchy-plugin-marketplac
    • Network accessline 103
      See [stream accumulation](https://github.com/omacom/omarchy-plugin-marketplace/issues/7047#issuecomment-5735500611)
    • Network accessline 104
      and [transfer budgets](https://github.com/omacom/omarchy-plugin-marketplace/issues/6068#issuecomment-5735045519).
    • Network accessline 112
      signing key from that checkout retain the same problem. Authenticate final package bytes through installation, not just downloaded source. See [bootstrap re-review](https://github.com/omacom/omarchy-plugin-marketplace/issues/5371#issuecomme
    • Network accessline 114
      See [bootstrap re-review](https://github.com/omacom/omarchy-plugin-marketplace/issues/5371#issuecomment-5745040622).
    • Network accessline 124
      loopback literal. Handle redirects and resolved destinations under the same policy. Remote use requires the agreed explicit opt-in. See [local API review](https://github.com/omacom/omarchy-plugin-marketplace/issues/8352#issuecomment-5819807
    • Network accessline 125
      policy. Remote use requires the agreed explicit opt-in. See [local API review](https://github.com/omacom/omarchy-plugin-marketplace/issues/8352#issuecomment-5819807404) and [local-only leak](https://github.com/omacom/omarchy-plugin-marketpl
    • Network accessline 126
      See [local API review](https://github.com/omacom/omarchy-plugin-marketplace/issues/8352#issuecomment-5819807404) and [local-only leak](https://github.com/omacom/omarchy-plugin-marketplace/issues/8434#issuecomment-5819147536), checked 24 Sep
    • Network accessline 127
      and [local-only leak](https://github.com/omacom/omarchy-plugin-marketplace/issues/8434#issuecomment-5819147536), checked 24 September 2026. Test allowed clients, unauthenticated requests, hostile Host/Origin values and deceptive endpoint na
    • Network accessline 137
      close responses on every exit and join/reap readers within a bounded wait. Repeat cancellation with a full queue to expose retained threads and resources. See [slow reads](https://github.com/omacom/omarchy-plugin-marketplace/issues/8371#iss
    • Network accessline 138
      Repeat cancellation with a full queue to expose retained threads and resources. See [slow reads](https://github.com/omacom/omarchy-plugin-marketplace/issues/8371#issuecomment-5819019831), [git children](https://github.com/omacom/omarchy-plu
    • Network accessline 139
      See [slow reads](https://github.com/omacom/omarchy-plugin-marketplace/issues/8371#issuecomment-5819019831),
    • Network accessline 140
      [git children](https://github.com/omacom/omarchy-plugin-marketplace/issues/8392#issuecomment-5819774887)
    • Network accessline 141
      and [queue shutdown](https://github.com/omacom/omarchy-plugin-marketplace/issues/5619#issuecomment-5784771145).
    • Network accessline 145
      a pathname check followed by numeric-PID signaling can race. Prefer a suitable user service/cgroup or a race-free process handle and avoid elevating user-process cleanup. See [DevWatch](https://github.com/omacom/omarchy-plugin-marketplace/i
    • Network accessline 146
      user service/cgroup or a race-free process handle and avoid elevating user-process cleanup. See [DevWatch](https://github.com/omacom/omarchy-plugin-marketplace/issues/7927#issuecomment-5815441990) and [Phonecam](https://github.com/omacom/om
    • Network accessline 147
      cleanup. See [DevWatch](https://github.com/omacom/omarchy-plugin-marketplace/issues/7927#issuecomment-5815441990)
    • Network accessline 148
      and [Phonecam](https://github.com/omacom/omarchy-plugin-marketplace/issues/7497#issuecomment-5795173133).
    • Network accessline 156
      external Text sink to PlainText. Verify every visible button and IPC invocation uses the actual manifest ID, especially after a rename. See [Clipbar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8478#issuecomment-5819340291),
    • Network accessline 157
      uses the actual manifest ID, especially after a rename. See [Clipbar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8478#issuecomment-5819340291), [persisted location](https://github.com/omacom/omarchy-plugin-marketplace/issue
    • Network accessline 158
      See [Clipbar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8478#issuecomment-5819340291),
    • Network accessline 159
      [persisted location](https://github.com/omacom/omarchy-plugin-marketplace/issues/8395#issuecomment-5819055337)
    • Network accessline 160
      and [panel target](https://github.com/omacom/omarchy-plugin-marketplace/issues/8463#issuecomment-5819309888).
    • Network accessline 164
      Read current reviewer disposition before calling a concern a listing blocker. [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-5970593063)
    • Network accessline 165
      [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-5970593063)
    • Network accessline 166
      and [OmaRead](https://github.com/omacom/omarchy-plugin-marketplace/issues/9174#issuecomment-5970439231)
    • Network accessline 173
      apply the policy to redirects and proxy routing too. For credential-bearing requests, prefer refusing redirects; never forward secrets to a new origin. See [Sift](https://github.com/omacom/omarchy-plugin-marketplace/issues/9858#issuecomment
    • Network accessline 174
      requests, prefer refusing redirects; never forward secrets to a new origin. See [Sift](https://github.com/omacom/omarchy-plugin-marketplace/issues/9858#issuecomment-5970803404) and [TMOS](https://github.com/omacom/omarchy-plugin-marketplace
    • Network accessline 175
      See [Sift](https://github.com/omacom/omarchy-plugin-marketplace/issues/9858#issuecomment-5970803404)
    • Network accessline 176
      and [TMOS](https://github.com/omacom/omarchy-plugin-marketplace/issues/8574#issuecomment-5823505773).
    • Network accessline 180
      state in the backend immediately before forwarding input; a masked UI field or polled password-prompt state cannot protect secrets in argv/scrollback. See [Pianobar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8898#issuecomm
    • Network accessline 181
      or polled password-prompt state cannot protect secrets in argv/scrollback. See [Pianobar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8898#issuecomment-5855383375) and its [stale prompt check](https://github.com/omacom/omarc
    • Network accessline 182
      See [Pianobar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8898#issuecomment-5855383375)
    • Network accessline 183
      and its [stale prompt check](https://github.com/omacom/omarchy-plugin-marketplace/issues/8898#issuecomment-5858550108).
    • Network accessline 187
      operation, trusted helper and secret recipient to the same verified flow; names, caller-supplied command text and an arbitrary child of real sudo are insufficient. See [Doorman](https://github.com/omacom/omarchy-plugin-marketplace/issues/95
    • Dangerous shell operationline 188
      caller-supplied command text and an arbitrary child of real sudo are insufficient.
    • Network accessline 188
      caller-supplied command text and an arbitrary child of real sudo are insufficient. See [Doorman](https://github.com/omacom/omarchy-plugin-marketplace/issues/9558#issuecomment-5961920299). Loopback alone also does not isolate private history
    • Network accessline 189
      See [Doorman](https://github.com/omacom/omarchy-plugin-marketplace/issues/9558#issuecomment-5961920299). Loopback alone also does not isolate private history from other local accounts; authenticate those reads or use a suitably protected Un
    • Network accessline 190
      Loopback alone also does not isolate private history from other local accounts; authenticate those reads or use a suitably protected Unix socket. See [Umbra](https://github.com/omacom/omarchy-plugin-marketplace/issues/8928#issuecomment-5928
    • Network accessline 192
      See [Umbra](https://github.com/omacom/omarchy-plugin-marketplace/issues/8928#issuecomment-5928250307).
    • Network accessline 195
      or invoking Git; reject backup-supplied symlinks before writes. A restore must stay within the authorized plugin set. See [Settings Sync](https://github.com/omacom/omarchy-plugin-marketplace/issues/9849#issuecomment-5970334443).
    • Network accessline 196
      stay within the authorized plugin set. See [Settings Sync](https://github.com/omacom/omarchy-plugin-marketplace/issues/9849#issuecomment-5970334443). Ensure success describes the full promised state across all active providers;
    • Network accessline 197
      [Settings Sync](https://github.com/omacom/omarchy-plugin-marketplace/issues/9849#issuecomment-5970334443).
    • Network accessline 198
      Ensure success describes the full promised state across all active providers; checking only resolved cannot establish discovery is disabled if Avahi still publishes. See [Network Persona](https://github.com/omacom/omarchy-plugin-marketplace
    • Network accessline 200
      publishes. See [Network Persona](https://github.com/omacom/omarchy-plugin-marketplace/issues/9854#issuecomment-5970652519).

    plugins/build-omarchy-plugins/skills/omarchy-service-ipc/references/service-contract.md

    • Network accessline 54
      Source: [Quattro shell contract, reviewed 29 September 2026](https://github.com/omacom/omarchy/blob/e332dc975d5f635294c497ebb54feb98dc3d89eb/docs/omarchy-shell.md).

    skills/omarchy-bar-widget/references/widget-contract.md

    • Network accessline 67
      Quattro's [reviewed 29 September contract](https://github.com/omacom/omarchy/blob/e332dc975d5f635294c497ebb54feb98dc3d89eb/docs/omarchy-shell.md)

    skills/omarchy-plugin-debug/references/failure-ladder.md

    • Dangerous shell operationline 25
      omarchy debug --no-sudo --print
    • Network accessline 50
      Source: [reviewed shell contract](https://github.com/omacom/omarchy/blob/e332dc975d5f635294c497ebb54feb98dc3d89eb/docs/omarchy-shell.md).

    skills/omarchy-plugin-debug/scripts/doctor.py

    • Executable scriptline 1
      #!/usr/bin/env python3
    • Access to secretsline 101
      [Credential-related source omitted]

    skills/omarchy-plugin-demo/scripts/demo_preflight.py

    • Executable scriptline 1
      #!/usr/bin/env python3
    • Dangerous shell operationline 68
      if "rm -rf" in text:

    skills/omarchy-plugin-design/references/host-workflow.md

    • Network accessline 33
      Sources: [starter](https://github.com/omacom/omarchy/blob/cce8b1c971df64a7610b818ff8819e4bea04584a/shell/plugins/agents/Panel.qml), [installed guide](https://github.com/omacom/omarchy/blob/cce8b1c971df64a7610b818ff8819e4bea04584a/default/ag

    skills/omarchy-plugin-design/references/integration-boundaries.md

    • Network accessline 20
      Evidence: [AppSignal](https://github.com/omacom/omarchy-plugin-marketplace/issues/7141#issuecomment-5722655664),
    • Network accessline 21
      [Chezmoi Hound](https://github.com/omacom/omarchy-plugin-marketplace/issues/7526#issuecomment-5746267624),
    • Network accessline 22
      [Jarvis](https://github.com/omacom/omarchy-plugin-marketplace/issues/5614#issuecomment-5734988047).
    • Network accessline 28
      broker is needed, substantiate the deployed-code and credential trust boundary; do not send bearer/refresh credentials to an unverified default shared service. See [Coinbase](https://github.com/omacom/omarchy-plugin-marketplace/issues/7520#
    • Network accessline 30
      See [Coinbase](https://github.com/omacom/omarchy-plugin-marketplace/issues/7520#issuecomment-5741977697).
    • Network accessline 41
      Evidence: [OmaNomad](https://github.com/omacom/omarchy-plugin-marketplace/issues/5371#issuecomment-5745040622),
    • Network accessline 42
      [signing-key bootstrap](https://github.com/omacom/omarchy-plugin-marketplace/issues/5402#issuecomment-5672481038).
    • Dangerous shell operationline 49
      name, or caller-selected askpass child of genuine sudo does not establish the
    • Network accessline 52
      not only an obviously forged identity. Keep fail-closed behavior when the trusted helper/identity is unavailable. See [Doorman follow-up](https://github.com/omacom/omarchy-plugin-marketplace/issues/9558#issuecomment-5961920299).
    • Network accessline 54
      [Doorman follow-up](https://github.com/omacom/omarchy-plugin-marketplace/issues/9558#issuecomment-5961920299).

    skills/omarchy-plugin-design/references/kind-selection.md

    • Network accessline 66
      Authoritative sources: [Omarchy shell documentation](https://github.com/basecamp/omarchy/blob/quattro/docs/omarchy-shell.md)
    • Network accessline 67
      [Omarchy shell documentation](https://github.com/basecamp/omarchy/blob/quattro/docs/omarchy-shell.md)
    • Network accessline 68
      and [shell plugin manual](https://omarchy.org/manual/shell-plugins/).

    skills/omarchy-plugin-migrate/SKILL.md

    • Dangerous shell operationline 12
      - `omarchy plugin add` clones/validates files and changes enabled state; it runs no installation hooks or sudo setup. Document explicit prerequisites or a separate package path.

    skills/omarchy-plugin-publish/references/marketplace-submission.md

    • Network accessline 3
      Verified against [`omacom/omarchy-plugin-marketplace`](https://github.com/omacom/omarchy-plugin-marketplace)
    • Network accessline 4
      [`omacom/omarchy-plugin-marketplace`](https://github.com/omacom/omarchy-plugin-marketplace)
    • Network accessline 91
      These rules are pinned in the bundle's verification form and [verification workflow](https://github.com/omacom/omarchy-plugin-marketplace/blob/bdf7c4fd1c0cb2bc1175dc0931362727aa4a0cb3/VERIFICATION.md).
    • Network accessline 92
      [verification workflow](https://github.com/omacom/omarchy-plugin-marketplace/blob/bdf7c4fd1c0cb2bc1175dc0931362727aa4a0cb3/VERIFICATION.md).
    • Network accessline 101
      - [Malformed CLI intake](https://github.com/omacom/omarchy-plugin-marketplace/commit/1f845b73e7324ee0bde2f7c121032066aa9cc295):   malformed `[Plugin]:` requests now receive the submission label so their actual
    • Network accessline 103
      form-error report can publish. The label is not a successful validation. Fix   the existing body and retry; do not diagnose every intake error as plugin code. - [Migrated repositories](https://github.com/omacom/omarchy-plugin-marketplace/co
    • Network accessline 104
      the existing body and retry; do not diagnose every intake error as plugin code. - [Migrated repositories](https://github.com/omacom/omarchy-plugin-marketplace/commit/8be8e3be5fc0a0592cc90b9d37d858177a624a84):   verification/update requests
    • Network accessline 105
      - [Migrated repositories](https://github.com/omacom/omarchy-plugin-marketplace/commit/8be8e3be5fc0a0592cc90b9d37d858177a624a84):   verification/update requests may name a recorded former repository of their   own listing. The workflow resol
    • Network accessline 109
      Prefer the current registered canonical URL. Do not repurpose Verify for a new   listing or rewrite historical evidence to make a mismatch disappear. - [Refresh scheduling](https://github.com/omacom/omarchy-plugin-marketplace/commit/74836ff
    • Network accessline 110
      listing or rewrite historical evidence to make a mismatch disappear. - [Refresh scheduling](https://github.com/omacom/omarchy-plugin-marketplace/commit/74836ff40c4f55f04aafbb401e557deb0a770bd0):   unchanged previously passing sources can de
    • Network accessline 111
      - [Refresh scheduling](https://github.com/omacom/omarchy-plugin-marketplace/commit/74836ff40c4f55f04aafbb401e557deb0a770bd0):
    • Network accessline 120
      retain maintainer authority over classification; no local helper here sets the marketplace's manual override. Examples: [Pocket](https://github.com/omacom/omarchy-plugin-marketplace/issues/9872#issuecomment-5971720907),
    • Network accessline 121
      marketplace's manual override. Examples: [Pocket](https://github.com/omacom/omarchy-plugin-marketplace/issues/9872#issuecomment-5971720907), [OMeetingBar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9860#issuecomment-5970904
    • Network accessline 122
      [Pocket](https://github.com/omacom/omarchy-plugin-marketplace/issues/9872#issuecomment-5971720907),
    • Network accessline 123
      [OMeetingBar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9860#issuecomment-5970904348),
    • Network accessline 124
      [TMOS](https://github.com/omacom/omarchy-plugin-marketplace/issues/8574#issuecomment-5972030850).

    skills/omarchy-plugin-publish/references/review-response.md

    • Network accessline 27
      not automatically equivalent. This concerns the desktop plugin being built, not this agent-skills bundle, whose intended payload is instructions. See [review #4744](https://github.com/omacom/omarchy-plugin-marketplace/issues/4744#issuecomme
    • Network accessline 29
      See [review #4744](https://github.com/omacom/omarchy-plugin-marketplace/issues/4744#issuecomment-5642689162).
    • Network accessline 38
      Checked 13 September 2026 against marketplace commit `55efec9646cc24ca3ae8c427440043fa745ada49` and the two bot reports on [Markets update #6586](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586).
    • Network accessline 39
      `55efec9646cc24ca3ae8c427440043fa745ada49` and the two bot reports on [Markets update #6586](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586). The [compatibility report](https://github.com/omacom/omarchy-plugin-marketplace/
    • Network accessline 40
      [Markets update #6586](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586).
    • Network accessline 41
      The [compatibility report](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586#issuecomment-5648889073) passed, while the [security report](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586#issuecomment-564889946
    • Network accessline 42
      passed, while the [security report](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586#issuecomment-5648899465) required privilege review solely for README prose: “This plugin never requests sudo, installs packages, starts a s
    • Dangerous shell operationline 53
      not arbitrary English: `No sudo or pkexec is required.` is a documented example;
    • Network accessline 69
      Prepare any response within the user's scope; send it only with authorization. The authoritative policy and limits are in the pinned [security policy](https://github.com/omacom/omarchy-plugin-marketplace/blob/bdf7c4fd1c0cb2bc1175dc093136272
    • Network accessline 71
      [security policy](https://github.com/omacom/omarchy-plugin-marketplace/blob/bdf7c4fd1c0cb2bc1175dc0931362727aa4a0cb3/SECURITY.md#automated-security-baseline).
    • Network accessline 80
      or SHA-shaped reference does not prove least privilege, provenance or complete pinning. Container jobs and transitive dependency resolution still need manual review. See [CI review](https://github.com/omacom/omarchy-plugin-marketplace/issue
    • Network accessline 82
      review. See [CI review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7491#issuecomment-5741754091).
    • Network accessline 86
      classifying ordinary documentation; keep development-only agent instructions outside the distributed desktop plugin. This is not a ban on intentional agent skill bundles. See [hook review](https://github.com/omacom/omarchy-plugin-marketplac
    • Network accessline 88
      skill bundles. See [hook review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7476#issuecomment-5746209569).
    • Network accessline 90
      A scanner may also match command strings inside a bundled validator's rules. [Kamal's baseline](https://github.com/omacom/omarchy-plugin-marketplace/issues/7656#issuecomment-5742922054)
    • Network accessline 91
      [Kamal's baseline](https://github.com/omacom/omarchy-plugin-marketplace/issues/7656#issuecomment-5742922054)
    • Network accessline 98
      [Workbench review](https://github.com/omacom/omarchy-plugin-marketplace/issues/3795#issuecomment-5784382912)
    • Network accessline 109
      forward. Track active, fixed, withdrawn and unverified separately. Hancore withdrew earlier allocation concerns as security listing blockers in [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-597059
    • Network accessline 110
      withdrew earlier allocation concerns as security listing blockers in [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-5970593063) and [OmaRead](https://github.com/omacom/omarchy-plugin-marketplace/is
    • Network accessline 111
      [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-5970593063)
    • Network accessline 112
      and [OmaRead](https://github.com/omacom/omarchy-plugin-marketplace/issues/9174#issuecomment-5970439231),
    • Network accessline 124
      For example, [Doorman](https://github.com/omacom/omarchy-plugin-marketplace/issues/9558#issuecomment-5952627749)

    skills/omarchy-plugin-publish/references/submission-options.md

    • Network accessline 5
      Recommend [Omakit](https://github.com/mtolhuys/omakit) to run submission checks
    • Network accessline 6
      and prepare a reviewable draft with `omakit submit <plugin-repo>`. Consult its [current command documentation](https://github.com/mtolhuys/omakit/blob/main/docs/SUBMIT.md) and run against the intended committed candidate. Record the candida
    • Network accessline 7
      [current command documentation](https://github.com/mtolhuys/omakit/blob/main/docs/SUBMIT.md)

    skills/omarchy-plugin-publish/scripts/prepare_submission.py

    • Executable scriptline 1
      #!/usr/bin/env python3
    • Network accessline 34
      ssh = re.fullmatch(r"git@github\.com:([^/]+)/(.+?)(?:\.git)?", value)     if ssh:         return f"https://github.com/{ssh.group(1)}/{ssh.group(2)}"
    • Network accessline 35
      if ssh:         return f"https://github.com/{ssh.group(1)}/{ssh.group(2)}"     if value.startswith("https://github.com/"):
    • Network accessline 36
      return f"https://github.com/{ssh.group(1)}/{ssh.group(2)}"
    • Network accessline 37
      if value.startswith("https://github.com/"):
    • Network accessline 76
      return 2     repository = (args.repository or git_repository(root)).removesuffix(".git").rstrip("/")     if not re.fullmatch(r"https://github\.com/[^/]+/[^/]+", repository):
    • Network accessline 77
      repository = (args.repository or git_repository(root)).removesuffix(".git").rstrip("/")     if not re.fullmatch(r"https://github\.com/[^/]+/[^/]+", repository):         print("prepare_submission.py: provide a GitHub repository root URL", fi
    • Network accessline 78
      if not re.fullmatch(r"https://github\.com/[^/]+/[^/]+", repository):

    skills/omarchy-plugin-release/references/release-contract.md

    • Network accessline 46
      Apply these checks to the installation/build paths the plugin actually uses. Recent [Mynah review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7255#issuecomment-5745951194)
    • Network accessline 47
      Recent [Mynah review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7255#issuecomment-5745951194)
    • Network accessline 48
      and [MFA review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7491#issuecomment-5741754091),
    • Network accessline 64
      downloader default and minimum accepted backend version. Test a clean install,   upgrade from the affected version and a stale preinstalled/local executable.   [Bitwarden review](https://github.com/omacom/omarchy-plugin-marketplace/issues/3
    • Network accessline 65
      upgrade from the affected version and a stale preinstalled/local executable.   [Bitwarden review](https://github.com/omacom/omarchy-plugin-marketplace/issues/3098#issuecomment-5744992291)   found fixed source while the plugin still download
    • Network accessline 66
      [Bitwarden review](https://github.com/omacom/omarchy-plugin-marketplace/issues/3098#issuecomment-5744992291)
    • Network accessline 78
      must leave unrelated and user-modified files intact. Exercise fresh install, repeat install, conflicting target, modified managed file and removal cases. See [NetScope](https://github.com/omacom/omarchy-plugin-marketplace/issues/5619#issuec
    • Network accessline 79
      repeat install, conflicting target, modified managed file and removal cases. See [NetScope](https://github.com/omacom/omarchy-plugin-marketplace/issues/5619#issuecomment-5819540608) and [MoErgo](https://github.com/omacom/omarchy-plugin-mark
    • Network accessline 80
      See [NetScope](https://github.com/omacom/omarchy-plugin-marketplace/issues/5619#issuecomment-5819540608)
    • Network accessline 81
      and [MoErgo](https://github.com/omacom/omarchy-plugin-marketplace/issues/7107#issuecomment-5819566127).
    • Network accessline 85
      changes. Recheck the commit and complete loadable tree after checkout and before validation/rescan; account for ignored executable source too. Preserve that identity until loading. See [Plugin Updates](https://github.com/omacom/omarchy-plug
    • Network accessline 87
      identity until loading. See [Plugin Updates](https://github.com/omacom/omarchy-plugin-marketplace/issues/8250#issuecomment-5801511763).
    • Network accessline 92
      artifact digest to the expected repository, trusted workflow and full source SHA; an owner-only attestation check is too broad. Check before extraction/execution. See [toolchain](https://github.com/omacom/omarchy-plugin-marketplace/issues/7
    • Network accessline 93
      an owner-only attestation check is too broad. Check before extraction/execution. See [toolchain](https://github.com/omacom/omarchy-plugin-marketplace/issues/7631#issuecomment-5800962204) and [attestation identity](https://github.com/omacom/
    • Network accessline 94
      See [toolchain](https://github.com/omacom/omarchy-plugin-marketplace/issues/7631#issuecomment-5800962204)
    • Network accessline 95
      and [attestation identity](https://github.com/omacom/omarchy-plugin-marketplace/issues/7107#issuecomment-5792174978).
    • Network accessline 99
      UI does not authenticate the required backend. A checksum from the same movable tag as a root bootstrap supplies no independent trust. See [Omatalk](https://github.com/omacom/omarchy-plugin-marketplace/issues/8407#issuecomment-5818821005)
    • Network accessline 100
      tag as a root bootstrap supplies no independent trust. See [Omatalk](https://github.com/omacom/omarchy-plugin-marketplace/issues/8407#issuecomment-5818821005) and [OmaNitro](https://github.com/omacom/omarchy-plugin-marketplace/issues/5540#i
    • Network accessline 101
      [Omatalk](https://github.com/omacom/omarchy-plugin-marketplace/issues/8407#issuecomment-5818821005)
    • Network accessline 102
      and [OmaNitro](https://github.com/omacom/omarchy-plugin-marketplace/issues/5540#issuecomment-5819470495).

    skills/omarchy-plugin-release/scripts/release_preflight.py

    • Executable scriptline 1
      #!/usr/bin/env python3
    • Network accessline 45
      match = re.fullmatch(r"git@github\.com:([^/]+)/(.+?)(?:\.git)?", value)     if match:         return f"https://github.com/{match.group(1)}/{match.group(2)}"
    • Network accessline 46
      if match:         return f"https://github.com/{match.group(1)}/{match.group(2)}"     if value.startswith("https://github.com/"):
    • Network accessline 47
      return f"https://github.com/{match.group(1)}/{match.group(2)}"
    • Network accessline 48
      if value.startswith("https://github.com/"):
    • Network accessline 226
      else:                 normalized = normalize_remote(remote.stdout)                 if not re.fullmatch(r"https://github\.com/[^/]+/[^/]+", normalized):
    • Network accessline 227
      normalized = normalize_remote(remote.stdout)                 if not re.fullmatch(r"https://github\.com/[^/]+/[^/]+", normalized):                     add("error", "origin-github", "Origin is not a GitHub repository root URL.", normalized)
    • Network accessline 228
      if not re.fullmatch(r"https://github\.com/[^/]+/[^/]+", normalized):

    skills/omarchy-plugin-scaffold/assets/repository-template.lock.json

    • Network accessline 1
      {   "schemaVersion": 1,   "repository": "https://github.com/tcballard/omarchy-plugin-template",
    • Network accessline 2
      "schemaVersion": 1,   "repository": "https://github.com/tcballard/omarchy-plugin-template",   "commit": "f99681e69937d21c2d4414ac9f65a0fd01fea714",
    • Network accessline 3
      "repository": "https://github.com/tcballard/omarchy-plugin-template",

    skills/omarchy-plugin-scaffold/assets/repository-template/.template/blueprint/AGENTS.md

    • Network accessline 5
      - Run ./tests/run. Follow docs/DEVELOPMENT.md for native checks. - Use [build-omarchy-plugins](https://github.com/tcballard/build-omarchy-plugins) guidance and verify current upstream contracts before relying on version-specific APIs.
    • Network accessline 6
      - Use [build-omarchy-plugins](https://github.com/tcballard/build-omarchy-plugins) guidance and verify current upstream contracts before relying on version-specific APIs.

    skills/omarchy-plugin-scaffold/assets/repository-template/.template/blueprint/CREDITS.md

    • Network accessline 8
      - plugin conventions: [build-omarchy-plugins](https://github.com/tcballard/build-omarchy-plugins).
    • Network accessline 9
      - Community badge artwork: [omarchy-badges](https://github.com/tcballard/omarchy-badges), pinned to 75975e5b5bf75e7ede3764bcd2950046f7abfe2c. No badge artwork is bundled.

    skills/omarchy-plugin-scaffold/assets/repository-template/.template/blueprint/README.md

    • Network accessline 5
      <p align="center"><a href="https://github.com/tcballard/omarchy-badges"><img alt="Built for Omarchy: Plugin" height="20" src="https://raw.githubusercontent.com/tcballard/omarchy-badges/75975e5b5bf75e7ede3764bcd2950046f7abfe2c/badges/v1/omar
    • Network accessline 32
      Built from [Build Omarchy Plugins](https://github.com/tcballard/build-omarchy-plugins) guidance and the Omarchy template set. [Sources, inspiration and assets](CREDITS.md).

    skills/omarchy-plugin-scaffold/assets/repository-template/AGENTS.md

    • Network accessline 5
      - Run ./tests/run. Follow docs/DEVELOPMENT.md for native checks. - Use [build-omarchy-plugins](https://github.com/tcballard/build-omarchy-plugins) guidance and verify current upstream contracts before relying on version-specific APIs.
    • Network accessline 6
      - Use [build-omarchy-plugins](https://github.com/tcballard/build-omarchy-plugins) guidance and verify current upstream contracts before relying on version-specific APIs.

    skills/omarchy-plugin-scaffold/assets/repository-template/CREDITS.md

    • Network accessline 8
      - plugin conventions: [build-omarchy-plugins](https://github.com/tcballard/build-omarchy-plugins).
    • Network accessline 9
      - Community badge artwork: [omarchy-badges](https://github.com/tcballard/omarchy-badges), pinned to 75975e5b5bf75e7ede3764bcd2950046f7abfe2c. No badge artwork is bundled.

    skills/omarchy-plugin-scaffold/assets/repository-template/README.md

    • Network accessline 5
      <p align="center"><a href="https://github.com/tcballard/omarchy-badges"><img alt="Built for Omarchy: Plugin" height="20" src="https://raw.githubusercontent.com/tcballard/omarchy-badges/75975e5b5bf75e7ede3764bcd2950046f7abfe2c/badges/v1/omar
    • Network accessline 32
      Built from [Build Omarchy Plugins](https://github.com/tcballard/build-omarchy-plugins) guidance and the Omarchy template set. [Sources, inspiration and assets](CREDITS.md).

    skills/omarchy-plugin-scaffold/assets/repository-template/scripts/archive.mjs

    • Executable scriptline 1
      #!/usr/bin/env node

    skills/omarchy-plugin-scaffold/assets/repository-template/scripts/check.mjs

    • Executable scriptline 1
      #!/usr/bin/env node

    skills/omarchy-plugin-scaffold/assets/repository-template/scripts/github.mjs

    • Executable scriptline 1
      #!/usr/bin/env node

    skills/omarchy-plugin-scaffold/assets/repository-template/scripts/init.mjs

    • Executable scriptline 1
      #!/usr/bin/env node
    • Network accessline 7
      const input = process.argv.slice(2);   if (input.includes('--help')) {     console.log('node scripts/init.mjs --owner OWNER --repo REPO --slug SLUG --name "Project name" --author "Author" [--id io.github.owner.slug] [--description "Purpose"
    • Network accessline 8
      if (input.includes('--help')) {     console.log('node scripts/init.mjs --owner OWNER --repo REPO --slug SLUG --name "Project name" --author "Author" [--id io.github.owner.slug] [--description "Purpose"] [--inspiration https://...] [--year 2
    • Network accessline 9
      console.log('node scripts/init.mjs --owner OWNER --repo REPO --slug SLUG --name "Project name" --author "Author" [--id io.github.owner.slug] [--description "Purpose"] [--inspiration https://...] [--year 2026]');

    skills/omarchy-plugin-scaffold/assets/repository-template/scripts/template.mjs

    • Executable scriptline 1
      Executable file
    • Network accessline 41
      values[key.toUpperCase() + '_DESKTOP'] = String(value).replaceAll('\\','\\\\');   }   values.REPO_URL = `https://github.com/${c.owner}/${c.repo}`;
    • Network accessline 42
      }   values.REPO_URL = `https://github.com/${c.owner}/${c.repo}`;   values.CRATE = c.slug.replaceAll('-', '_');
    • Network accessline 43
      values.REPO_URL = `https://github.com/${c.owner}/${c.repo}`;

    skills/omarchy-plugin-scaffold/assets/repository-template/tests/run

    • Executable scriptline 1
      #!/usr/bin/env bash

    skills/omarchy-plugin-scaffold/assets/repository-template/tests/template.test.mjs

    • Executable scriptline 1
      Executable file
    • Network accessline 10
      test('identity input rejects paths, reserved IDs and multiline values',()=>{   const c=readJSON(path.join(root,'.template/project.json'));   for(const patch of [{slug:'../../x'},{owner:'-flag'},{id:'omarchy.foo.bar'},{name:'x\ny'},{repo:'..
    • Network accessline 11
      const c=readJSON(path.join(root,'.template/project.json'));   for(const patch of [{slug:'../../x'},{owner:'-flag'},{id:'omarchy.foo.bar'},{name:'x\ny'},{repo:'../other'},{inspiration:'https://user:pass@example.com'}]) assert.throws(()=>vali
    • Network accessline 12
      for(const patch of [{slug:'../../x'},{owner:'-flag'},{id:'omarchy.foo.bar'},{name:'x\ny'},{repo:'../other'},{inspiration:'https://user:pass@example.com'}]) assert.throws(()=>validate({...c,...patch}));

    skills/omarchy-plugin-scaffold/assets/templates/README.md.tpl

    • Network accessline 3
      [![Built for Omarchy: Plugin](https://raw.githubusercontent.com/tcballard/omarchy-badges/75975e5b5bf75e7ede3764bcd2950046f7abfe2c/badges/v1/omarchy-plugin.svg)](https://github.com/tcballard/omarchy-badges)

    skills/omarchy-plugin-scaffold/assets/templates/demo-run.tpl

    • Executable scriptline 1
      #!/usr/bin/env bash

    skills/omarchy-plugin-scaffold/assets/templates/preview.svg.tpl

    • Network accessline 1
      <svg xmlns="http://www.w3.org/2000/svg" width="1280" height="720" viewBox="0 0 1280 720">

    skills/omarchy-plugin-scaffold/assets/templates/tests-run.tpl

    • Executable scriptline 1
      #!/usr/bin/env bash

    skills/omarchy-plugin-scaffold/assets/templates/validate_manifest.py.tpl

    • Executable scriptline 1
      #!/usr/bin/env python3

    skills/omarchy-plugin-scaffold/references/generated-layout.md

    • Network accessline 68
      Pair the [community badge](https://github.com/tcballard/omarchy-badges) with
    • Network accessline 128
      <p>   <a href="https://github.com/tcballard/omarchy-badges"><img alt="Built for Omarchy: Plugin" height="20" src="https://raw.githubusercontent.com/tcballard/omarchy-badges/75975e5b5bf75e7ede3764bcd2950046f7abfe2c/badges/v1/omarchy-plugin.s
    • Network accessline 129
      <a href="https://github.com/tcballard/omarchy-badges"><img alt="Built for Omarchy: Plugin" height="20" src="https://raw.githubusercontent.com/tcballard/omarchy-badges/75975e5b5bf75e7ede3764bcd2950046f7abfe2c/badges/v1/omarchy-plugin.svg"></
    • Network accessline 130
      <a href="#compatibility"><img alt="Supported Omarchy versions: 4.0.0+" height="20" src="https://raw.githubusercontent.com/tcballard/omarchy-badges/dd84bb21f19caf617caa5b3c1af7ff3c6cb847c3/badges/v1/compatibility/omarchy-4.0.0-plus.svg"></a>
    • Network accessline 135
      actual workflow and licence. Add the destination Compatibility heading and its support/test notes before publishing the example. Choose the appropriate [compatibility preset](https://github.com/tcballard/omarchy-badges/blob/7e00b3342bddefab
    • Network accessline 136
      support/test notes before publishing the example. Choose the appropriate [compatibility preset](https://github.com/tcballard/omarchy-badges/blob/7e00b3342bddefab7fece63f4806e47f4b77bf7c/COMPATIBILITY.md) without changing an existing pinned
    • Network accessline 137
      [compatibility preset](https://github.com/tcballard/omarchy-badges/blob/7e00b3342bddefab7fece63f4806e47f4b77bf7c/COMPATIBILITY.md)

    skills/omarchy-plugin-scaffold/references/repository-template.md

    • Network accessline 24
      The ID is permanent once published. Set it explicitly; the default derives it from the owner and slug. Optional `--inspiration https://...` adds prominent
    • Network accessline 25
      from the owner and slug. Optional `--inspiration https://...` adds prominent

    skills/omarchy-plugin-scaffold/scripts/new_plugin.py

    • Executable scriptline 1
      #!/usr/bin/env python3
    • Network accessline 111
      parts = plugin_id.split(".")     if len(parts) >= 4 and parts[0:2] == ["io", "github"]:         return f"https://github.com/{parts[2]}/{output_name}"
    • Network accessline 112
      if len(parts) >= 4 and parts[0:2] == ["io", "github"]:         return f"https://github.com/{parts[2]}/{output_name}"     return "https://github.com/OWNER/REPOSITORY"
    • Network accessline 113
      return f"https://github.com/{parts[2]}/{output_name}"
    • Network accessline 114
      return "https://github.com/OWNER/REPOSITORY"

    skills/omarchy-plugin-scaffold/scripts/new_repository.mjs

    • Executable scriptline 1
      #!/usr/bin/env node
    • Network accessline 13
      const usage = `node "<skill-dir>/scripts/new_repository.mjs" --output /absolute/unused/path   --owner OWNER --repo REPO --slug SLUG --name "Plugin Name" --author "Author"   [--id io.github.owner.slug] [--description "Purpose"] [--inspiratio
    • Network accessline 14
      --owner OWNER --repo REPO --slug SLUG --name "Plugin Name" --author "Author"   [--id io.github.owner.slug] [--description "Purpose"] [--inspiration https://...]   [--year 2026]
    • Network accessline 15
      [--id io.github.owner.slug] [--description "Purpose"] [--inspiration https://...]

    skills/omarchy-plugin-test/references/plain-text.md

    • Network accessline 28
      Checked 30 October 2026: [Bluetooth names](https://github.com/omacom/omarchy-plugin-marketplace/issues/13257#issuecomment-6503501447),
    • Network accessline 29
      [stored account names](https://github.com/omacom/omarchy-plugin-marketplace/issues/13302#issuecomment-6508507122),
    • Network accessline 30
      [Qt ToolTip](https://doc.qt.io/qt-6/qml-qtquick-controls-tooltip.html).

    skills/omarchy-plugin-test/references/qml-testing.md

    • Network accessline 26
      The maintained [Basecamp Omarchy plugin](https://github.com/basecamp/omarchy-basecamp-plugin)
    • Network accessline 27
      [Basecamp Omarchy plugin](https://github.com/basecamp/omarchy-basecamp-plugin)

    skills/omarchy-plugin-test/references/review-response.md

    • Network accessline 27
      not automatically equivalent. This concerns the desktop plugin being built, not this agent-skills bundle, whose intended payload is instructions. See [review #4744](https://github.com/omacom/omarchy-plugin-marketplace/issues/4744#issuecomme
    • Network accessline 29
      See [review #4744](https://github.com/omacom/omarchy-plugin-marketplace/issues/4744#issuecomment-5642689162).
    • Network accessline 38
      Checked 13 September 2026 against marketplace commit `55efec9646cc24ca3ae8c427440043fa745ada49` and the two bot reports on [Markets update #6586](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586).
    • Network accessline 39
      `55efec9646cc24ca3ae8c427440043fa745ada49` and the two bot reports on [Markets update #6586](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586). The [compatibility report](https://github.com/omacom/omarchy-plugin-marketplace/
    • Network accessline 40
      [Markets update #6586](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586).
    • Network accessline 41
      The [compatibility report](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586#issuecomment-5648889073) passed, while the [security report](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586#issuecomment-564889946
    • Network accessline 42
      passed, while the [security report](https://github.com/omacom/omarchy-plugin-marketplace/issues/6586#issuecomment-5648899465) required privilege review solely for README prose: “This plugin never requests sudo, installs packages, starts a s
    • Dangerous shell operationline 53
      not arbitrary English: `No sudo or pkexec is required.` is a documented example;
    • Network accessline 69
      Prepare any response within the user's scope; send it only with authorization. The authoritative policy and limits are in the pinned [security policy](https://github.com/omacom/omarchy-plugin-marketplace/blob/bdf7c4fd1c0cb2bc1175dc093136272
    • Network accessline 71
      [security policy](https://github.com/omacom/omarchy-plugin-marketplace/blob/bdf7c4fd1c0cb2bc1175dc0931362727aa4a0cb3/SECURITY.md#automated-security-baseline).
    • Network accessline 80
      or SHA-shaped reference does not prove least privilege, provenance or complete pinning. Container jobs and transitive dependency resolution still need manual review. See [CI review](https://github.com/omacom/omarchy-plugin-marketplace/issue
    • Network accessline 82
      review. See [CI review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7491#issuecomment-5741754091).
    • Network accessline 86
      classifying ordinary documentation; keep development-only agent instructions outside the distributed desktop plugin. This is not a ban on intentional agent skill bundles. See [hook review](https://github.com/omacom/omarchy-plugin-marketplac
    • Network accessline 88
      skill bundles. See [hook review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7476#issuecomment-5746209569).
    • Network accessline 90
      A scanner may also match command strings inside a bundled validator's rules. [Kamal's baseline](https://github.com/omacom/omarchy-plugin-marketplace/issues/7656#issuecomment-5742922054)
    • Network accessline 91
      [Kamal's baseline](https://github.com/omacom/omarchy-plugin-marketplace/issues/7656#issuecomment-5742922054)
    • Network accessline 98
      [Workbench review](https://github.com/omacom/omarchy-plugin-marketplace/issues/3795#issuecomment-5784382912)
    • Network accessline 109
      forward. Track active, fixed, withdrawn and unverified separately. Hancore withdrew earlier allocation concerns as security listing blockers in [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-597059
    • Network accessline 110
      withdrew earlier allocation concerns as security listing blockers in [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-5970593063) and [OmaRead](https://github.com/omacom/omarchy-plugin-marketplace/is
    • Network accessline 111
      [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-5970593063)
    • Network accessline 112
      and [OmaRead](https://github.com/omacom/omarchy-plugin-marketplace/issues/9174#issuecomment-5970439231),
    • Network accessline 124
      For example, [Doorman](https://github.com/omacom/omarchy-plugin-marketplace/issues/9558#issuecomment-5952627749)

    skills/omarchy-plugin-test/references/test-matrix.md

    • Network accessline 58
      Choose cases for the implemented boundary; these are not automatic results of static validation or mandatory work for unrelated edits. Guidance checked against [recent marketplace review](https://github.com/omacom/omarchy-plugin-marketplace
    • Network accessline 59
      static validation or mandatory work for unrelated edits. Guidance checked against [recent marketplace review](https://github.com/omacom/omarchy-plugin-marketplace/issues/3098#issuecomment-5744992291) on 20 September 2026:
    • Network accessline 60
      [recent marketplace review](https://github.com/omacom/omarchy-plugin-marketplace/issues/3098#issuecomment-5744992291)
    • Network accessline 114
      - Restore: malicious plugin ID or checkout reference cannot target a sibling   repository; backup-supplied symlinks cannot redirect writes. - Display: `<img src="https://example.invalid/pixel">` remains literal through
    • Network accessline 115
      repository; backup-supplied symlinks cannot redirect writes. - Display: `<img src="https://example.invalid/pixel">` remains literal through   compact, expanded and shared controls. Static textFormat checks alone do not
    • Network accessline 116
      - Display: `<img src="https://example.invalid/pixel">` remains literal through

    skills/omarchy-plugin-test/references/upgrade-fixtures.md

    • Network accessline 15
      Checked 30 October 2026: [legacy cache](https://github.com/omacom/omarchy-plugin-marketplace/issues/13257#issuecomment-6502311163),
    • Network accessline 16
      [saved Wi-Fi profile](https://github.com/omacom/omarchy-plugin-marketplace/issues/13283#issuecomment-6513914836),
    • Network accessline 17
      [managed listener](https://github.com/omacom/omarchy-plugin-marketplace/issues/13323#issuecomment-6513057859).

    skills/omarchy-plugin-test/references/validation-options.md

    • Network accessline 22
      The settings check accepts `multiselect`, including object-valued options as used by Quattro's [Indicators manifest](https://github.com/omacom/omarchy/blob/947e2fc002d6831c7888b29b5761d59d29e69727/shell/plugins/bar/widgets/Indicators.manife
    • Network accessline 23
      used by Quattro's [Indicators manifest](https://github.com/omacom/omarchy/blob/947e2fc002d6831c7888b29b5761d59d29e69727/shell/plugins/bar/widgets/Indicators.manifest.json)
    • Network accessline 56
      Recommend [Omakit](https://github.com/mtolhuys/omakit) as an optional companion
    • Network accessline 74
      For a security review, recommend consulting the community [Omarchy plugin security skill](https://github.com/wbso-ai/omarchy-plugin-security-skill).
    • Network accessline 75
      [Omarchy plugin security skill](https://github.com/wbso-ai/omarchy-plugin-security-skill).
    • Network accessline 80
      For GUI and lifecycle checks on a disposable desktop, consider [OmaVM](https://github.com/mlclifton/omavm), which documents QEMU/KVM guests and
    • Network accessline 81
      [OmaVM](https://github.com/mlclifton/omavm), which documents QEMU/KVM guests and
    • Network accessline 89
      For checks on a separate Omarchy computer you already own and have paired, [ibara](https://ibara.app/docs/agents) exposes its desktop to an MCP agent.
    • Network accessline 90
      [ibara](https://ibara.app/docs/agents) exposes its desktop to an MCP agent.
    • Network accessline 97
      This is an optional remote-hardware route, not a disposable desktop or sandbox; missing pairing/access leaves those checks unrun. See the [first-task guide](https://ibara.app/docs/first-task) for setup and a practice task.
    • Network accessline 98
      missing pairing/access leaves those checks unrun. See the [first-task guide](https://ibara.app/docs/first-task) for setup and a practice task. The ibara references were checked on 20 October 2026; do not install or pair a
    • Network accessline 99
      [first-task guide](https://ibara.app/docs/first-task) for setup and a practice task.

    skills/omarchy-plugin-test/scripts/check_plain_text.py

    • Executable scriptline 1
      #!/usr/bin/env python3

    skills/omarchy-plugin-test/scripts/validate_plugin.py

    • Executable scriptline 1
      #!/usr/bin/env python3
    • Possible obfuscationline 521
      b"\xfe\xed\xfa\xce", b"\xfe\xed\xfa\xcf", b"\xce\xfa\xed\xfe", b"\xcf\xfa\xed\xfe",

    skills/omarchy-qml-patterns/references/hosted-qml.md

    • Network accessline 79
      Authoritative contract: [docs/omarchy-shell.md](https://github.com/omacom/omarchy/blob/cce8b1c971df64a7610b818ff8819e4bea04584a/docs/omarchy-shell.md).
    • Network accessline 80
      [docs/omarchy-shell.md](https://github.com/omacom/omarchy/blob/cce8b1c971df64a7610b818ff8819e4bea04584a/docs/omarchy-shell.md).

    skills/omarchy-qml-patterns/references/reviewer-boundaries.md

    • Network accessline 3
      Derived from HANCORE-linux's public reviews in [omacom/omarchy-plugin-marketplace](https://github.com/omacom/omarchy-plugin-marketplace/issues),
    • Network accessline 4
      [omacom/omarchy-plugin-marketplace](https://github.com/omacom/omarchy-plugin-marketplace/issues),
    • Network accessline 28
      shared controls too; formatting one parent does not secure every child sink. Keep intentional rich text fixed or generated from explicitly trusted content. See [review #3360](https://github.com/omacom/omarchy-plugin-marketplace/issues/3360#
    • Network accessline 30
      See [review #3360](https://github.com/omacom/omarchy-plugin-marketplace/issues/3360#issuecomment-5464817134).
    • Network accessline 37
      can otherwise keep a request alive. Test overflow, an unterminated line, stalled input and oversized error output on the actual production read path. See [review #1667](https://github.com/omacom/omarchy-plugin-marketplace/issues/1667#issuec
    • Network accessline 39
      See [review #1667](https://github.com/omacom/omarchy-plugin-marketplace/issues/1667#issuecomment-5451236689).
    • Network accessline 46
      interpreter too; Python isolation may be needed where inherited search paths could load code. Do not apply these Linux runtime choices to unrelated portable builder scripts. See [review #6292](https://github.com/omacom/omarchy-plugin-market
    • Network accessline 48
      builder scripts. See [review #6292](https://github.com/omacom/omarchy-plugin-marketplace/issues/6292#issuecomment-5645360550).
    • Network accessline 60
      stubborn child, child descendants, cancellation and late completion. Rate-limit public IPC, serialize state changes and bound restart/backoff attempts. See [review #6157](https://github.com/omacom/omarchy-plugin-marketplace/issues/6157#issu
    • Network accessline 62
      See [review #6157](https://github.com/omacom/omarchy-plugin-marketplace/issues/6157#issuecomment-5647018532).
    • Network accessline 71
      relative to the retained parent. When sharing state with another writer, check its revision before replacement; an unrelated plugin lock is insufficient. See [review #6426](https://github.com/omacom/omarchy-plugin-marketplace/issues/6426#is
    • Network accessline 73
      See [review #6426](https://github.com/omacom/omarchy-plugin-marketplace/issues/6426#issuecomment-5646894185).
    • Network accessline 80
      state. If a CLI cannot accept secrets safely, design the plugin around an already-configured account. Disclosure alone does not fix exposure. See [review #2766](https://github.com/omacom/omarchy-plugin-marketplace/issues/2766#issuecomment-5
    • Network accessline 82
      See [review #2766](https://github.com/omacom/omarchy-plugin-marketplace/issues/2766#issuecomment-5446596212).
    • Network accessline 94
      validated local artifact. If the required decoder is absent, fail closed instead of passing unvalidated bytes through. Declare the validating dependency. See [artwork review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7180#
    • Network accessline 96
      See [artwork review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7180#issuecomment-5735649258).
    • Network accessline 101
      constraints, and clean up partials on overflow/cancellation. Test many individually valid inputs as well as a single oversized input. See [stream accumulation](https://github.com/omacom/omarchy-plugin-marketplace/issues/7047#issuecomment-57
    • Network accessline 102
      valid inputs as well as a single oversized input. See [stream accumulation](https://github.com/omacom/omarchy-plugin-marketplace/issues/7047#issuecomment-5735500611) and [transfer budgets](https://github.com/omacom/omarchy-plugin-marketplac
    • Network accessline 103
      See [stream accumulation](https://github.com/omacom/omarchy-plugin-marketplace/issues/7047#issuecomment-5735500611)
    • Network accessline 104
      and [transfer budgets](https://github.com/omacom/omarchy-plugin-marketplace/issues/6068#issuecomment-5735045519).
    • Network accessline 112
      signing key from that checkout retain the same problem. Authenticate final package bytes through installation, not just downloaded source. See [bootstrap re-review](https://github.com/omacom/omarchy-plugin-marketplace/issues/5371#issuecomme
    • Network accessline 114
      See [bootstrap re-review](https://github.com/omacom/omarchy-plugin-marketplace/issues/5371#issuecomment-5745040622).
    • Network accessline 124
      loopback literal. Handle redirects and resolved destinations under the same policy. Remote use requires the agreed explicit opt-in. See [local API review](https://github.com/omacom/omarchy-plugin-marketplace/issues/8352#issuecomment-5819807
    • Network accessline 125
      policy. Remote use requires the agreed explicit opt-in. See [local API review](https://github.com/omacom/omarchy-plugin-marketplace/issues/8352#issuecomment-5819807404) and [local-only leak](https://github.com/omacom/omarchy-plugin-marketpl
    • Network accessline 126
      See [local API review](https://github.com/omacom/omarchy-plugin-marketplace/issues/8352#issuecomment-5819807404) and [local-only leak](https://github.com/omacom/omarchy-plugin-marketplace/issues/8434#issuecomment-5819147536), checked 24 Sep
    • Network accessline 127
      and [local-only leak](https://github.com/omacom/omarchy-plugin-marketplace/issues/8434#issuecomment-5819147536), checked 24 September 2026. Test allowed clients, unauthenticated requests, hostile Host/Origin values and deceptive endpoint na
    • Network accessline 137
      close responses on every exit and join/reap readers within a bounded wait. Repeat cancellation with a full queue to expose retained threads and resources. See [slow reads](https://github.com/omacom/omarchy-plugin-marketplace/issues/8371#iss
    • Network accessline 138
      Repeat cancellation with a full queue to expose retained threads and resources. See [slow reads](https://github.com/omacom/omarchy-plugin-marketplace/issues/8371#issuecomment-5819019831), [git children](https://github.com/omacom/omarchy-plu
    • Network accessline 139
      See [slow reads](https://github.com/omacom/omarchy-plugin-marketplace/issues/8371#issuecomment-5819019831),
    • Network accessline 140
      [git children](https://github.com/omacom/omarchy-plugin-marketplace/issues/8392#issuecomment-5819774887)
    • Network accessline 141
      and [queue shutdown](https://github.com/omacom/omarchy-plugin-marketplace/issues/5619#issuecomment-5784771145).
    • Network accessline 145
      a pathname check followed by numeric-PID signaling can race. Prefer a suitable user service/cgroup or a race-free process handle and avoid elevating user-process cleanup. See [DevWatch](https://github.com/omacom/omarchy-plugin-marketplace/i
    • Network accessline 146
      user service/cgroup or a race-free process handle and avoid elevating user-process cleanup. See [DevWatch](https://github.com/omacom/omarchy-plugin-marketplace/issues/7927#issuecomment-5815441990) and [Phonecam](https://github.com/omacom/om
    • Network accessline 147
      cleanup. See [DevWatch](https://github.com/omacom/omarchy-plugin-marketplace/issues/7927#issuecomment-5815441990)
    • Network accessline 148
      and [Phonecam](https://github.com/omacom/omarchy-plugin-marketplace/issues/7497#issuecomment-5795173133).
    • Network accessline 156
      external Text sink to PlainText. Verify every visible button and IPC invocation uses the actual manifest ID, especially after a rename. See [Clipbar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8478#issuecomment-5819340291),
    • Network accessline 157
      uses the actual manifest ID, especially after a rename. See [Clipbar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8478#issuecomment-5819340291), [persisted location](https://github.com/omacom/omarchy-plugin-marketplace/issue
    • Network accessline 158
      See [Clipbar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8478#issuecomment-5819340291),
    • Network accessline 159
      [persisted location](https://github.com/omacom/omarchy-plugin-marketplace/issues/8395#issuecomment-5819055337)
    • Network accessline 160
      and [panel target](https://github.com/omacom/omarchy-plugin-marketplace/issues/8463#issuecomment-5819309888).
    • Network accessline 164
      Read current reviewer disposition before calling a concern a listing blocker. [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-5970593063)
    • Network accessline 165
      [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-5970593063)
    • Network accessline 166
      and [OmaRead](https://github.com/omacom/omarchy-plugin-marketplace/issues/9174#issuecomment-5970439231)
    • Network accessline 173
      apply the policy to redirects and proxy routing too. For credential-bearing requests, prefer refusing redirects; never forward secrets to a new origin. See [Sift](https://github.com/omacom/omarchy-plugin-marketplace/issues/9858#issuecomment
    • Network accessline 174
      requests, prefer refusing redirects; never forward secrets to a new origin. See [Sift](https://github.com/omacom/omarchy-plugin-marketplace/issues/9858#issuecomment-5970803404) and [TMOS](https://github.com/omacom/omarchy-plugin-marketplace
    • Network accessline 175
      See [Sift](https://github.com/omacom/omarchy-plugin-marketplace/issues/9858#issuecomment-5970803404)
    • Network accessline 176
      and [TMOS](https://github.com/omacom/omarchy-plugin-marketplace/issues/8574#issuecomment-5823505773).
    • Network accessline 180
      state in the backend immediately before forwarding input; a masked UI field or polled password-prompt state cannot protect secrets in argv/scrollback. See [Pianobar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8898#issuecomm
    • Network accessline 181
      or polled password-prompt state cannot protect secrets in argv/scrollback. See [Pianobar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8898#issuecomment-5855383375) and its [stale prompt check](https://github.com/omacom/omarc
    • Network accessline 182
      See [Pianobar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8898#issuecomment-5855383375)
    • Network accessline 183
      and its [stale prompt check](https://github.com/omacom/omarchy-plugin-marketplace/issues/8898#issuecomment-5858550108).
    • Network accessline 187
      operation, trusted helper and secret recipient to the same verified flow; names, caller-supplied command text and an arbitrary child of real sudo are insufficient. See [Doorman](https://github.com/omacom/omarchy-plugin-marketplace/issues/95
    • Dangerous shell operationline 188
      caller-supplied command text and an arbitrary child of real sudo are insufficient.
    • Network accessline 188
      caller-supplied command text and an arbitrary child of real sudo are insufficient. See [Doorman](https://github.com/omacom/omarchy-plugin-marketplace/issues/9558#issuecomment-5961920299). Loopback alone also does not isolate private history
    • Network accessline 189
      See [Doorman](https://github.com/omacom/omarchy-plugin-marketplace/issues/9558#issuecomment-5961920299). Loopback alone also does not isolate private history from other local accounts; authenticate those reads or use a suitably protected Un
    • Network accessline 190
      Loopback alone also does not isolate private history from other local accounts; authenticate those reads or use a suitably protected Unix socket. See [Umbra](https://github.com/omacom/omarchy-plugin-marketplace/issues/8928#issuecomment-5928
    • Network accessline 192
      See [Umbra](https://github.com/omacom/omarchy-plugin-marketplace/issues/8928#issuecomment-5928250307).
    • Network accessline 195
      or invoking Git; reject backup-supplied symlinks before writes. A restore must stay within the authorized plugin set. See [Settings Sync](https://github.com/omacom/omarchy-plugin-marketplace/issues/9849#issuecomment-5970334443).
    • Network accessline 196
      stay within the authorized plugin set. See [Settings Sync](https://github.com/omacom/omarchy-plugin-marketplace/issues/9849#issuecomment-5970334443). Ensure success describes the full promised state across all active providers;
    • Network accessline 197
      [Settings Sync](https://github.com/omacom/omarchy-plugin-marketplace/issues/9849#issuecomment-5970334443).
    • Network accessline 198
      Ensure success describes the full promised state across all active providers; checking only resolved cannot establish discovery is disabled if Avahi still publishes. See [Network Persona](https://github.com/omacom/omarchy-plugin-marketplace
    • Network accessline 200
      publishes. See [Network Persona](https://github.com/omacom/omarchy-plugin-marketplace/issues/9854#issuecomment-5970652519).

    skills/omarchy-qml-patterns/references/translations.md

    • Network accessline 39
      Sources: [plugin guide](https://github.com/omacom/omarchy/blob/cce8b1c971df64a7610b818ff8819e4bea04584a/default/agents/skills/omarchy/plugins.md), [Translations.qml](https://github.com/omacom/omarchy/blob/cce8b1c971df64a7610b818ff8819e4bea0

    skills/omarchy-service-ipc/assets/private-request/read_request.py

    • Executable scriptline 1
      Executable file

    skills/omarchy-service-ipc/references/private-content.md

    • Network accessline 35
      Checked 30 October 2026: [ArchyWidgets](https://github.com/omacom/omarchy-plugin-marketplace/issues/13129#issuecomment-6474345255),
    • Network accessline 36
      [Omail's downstream filename leak](https://github.com/omacom/omarchy-plugin-marketplace/issues/13269#issuecomment-6504607813),
    • Network accessline 37
      [Quickshell Process](https://quickshell.org/docs/v0.2.1/types/Quickshell.Io/Process/).

    skills/omarchy-service-ipc/references/process-safety.md

    • Network accessline 39
      A read-only bind of the whole filesystem still exposes secrets; allowlist only required inputs and CLI state, and fail closed when isolation is unavailable. See [Chezmoi Hound](https://github.com/omacom/omarchy-plugin-marketplace/issues/752
    • Network accessline 41
      See [Chezmoi Hound](https://github.com/omacom/omarchy-plugin-marketplace/issues/7526#issuecomment-5746267624).
    • Network accessline 43
      Repository source cannot attest a live OAuth broker deployment. Use local or user-controlled authentication, or substantiate the deployed credential boundary before routing tokens through a shared service. See [Coinbase](https://github.com/
    • Network accessline 45
      before routing tokens through a shared service. See [Coinbase](https://github.com/omacom/omarchy-plugin-marketplace/issues/7520#issuecomment-5741977697).

    skills/omarchy-service-ipc/references/reviewer-boundaries.md

    • Network accessline 3
      Derived from HANCORE-linux's public reviews in [omacom/omarchy-plugin-marketplace](https://github.com/omacom/omarchy-plugin-marketplace/issues),
    • Network accessline 4
      [omacom/omarchy-plugin-marketplace](https://github.com/omacom/omarchy-plugin-marketplace/issues),
    • Network accessline 28
      shared controls too; formatting one parent does not secure every child sink. Keep intentional rich text fixed or generated from explicitly trusted content. See [review #3360](https://github.com/omacom/omarchy-plugin-marketplace/issues/3360#
    • Network accessline 30
      See [review #3360](https://github.com/omacom/omarchy-plugin-marketplace/issues/3360#issuecomment-5464817134).
    • Network accessline 37
      can otherwise keep a request alive. Test overflow, an unterminated line, stalled input and oversized error output on the actual production read path. See [review #1667](https://github.com/omacom/omarchy-plugin-marketplace/issues/1667#issuec
    • Network accessline 39
      See [review #1667](https://github.com/omacom/omarchy-plugin-marketplace/issues/1667#issuecomment-5451236689).
    • Network accessline 46
      interpreter too; Python isolation may be needed where inherited search paths could load code. Do not apply these Linux runtime choices to unrelated portable builder scripts. See [review #6292](https://github.com/omacom/omarchy-plugin-market
    • Network accessline 48
      builder scripts. See [review #6292](https://github.com/omacom/omarchy-plugin-marketplace/issues/6292#issuecomment-5645360550).
    • Network accessline 60
      stubborn child, child descendants, cancellation and late completion. Rate-limit public IPC, serialize state changes and bound restart/backoff attempts. See [review #6157](https://github.com/omacom/omarchy-plugin-marketplace/issues/6157#issu
    • Network accessline 62
      See [review #6157](https://github.com/omacom/omarchy-plugin-marketplace/issues/6157#issuecomment-5647018532).
    • Network accessline 71
      relative to the retained parent. When sharing state with another writer, check its revision before replacement; an unrelated plugin lock is insufficient. See [review #6426](https://github.com/omacom/omarchy-plugin-marketplace/issues/6426#is
    • Network accessline 73
      See [review #6426](https://github.com/omacom/omarchy-plugin-marketplace/issues/6426#issuecomment-5646894185).
    • Network accessline 80
      state. If a CLI cannot accept secrets safely, design the plugin around an already-configured account. Disclosure alone does not fix exposure. See [review #2766](https://github.com/omacom/omarchy-plugin-marketplace/issues/2766#issuecomment-5
    • Network accessline 82
      See [review #2766](https://github.com/omacom/omarchy-plugin-marketplace/issues/2766#issuecomment-5446596212).
    • Network accessline 94
      validated local artifact. If the required decoder is absent, fail closed instead of passing unvalidated bytes through. Declare the validating dependency. See [artwork review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7180#
    • Network accessline 96
      See [artwork review](https://github.com/omacom/omarchy-plugin-marketplace/issues/7180#issuecomment-5735649258).
    • Network accessline 101
      constraints, and clean up partials on overflow/cancellation. Test many individually valid inputs as well as a single oversized input. See [stream accumulation](https://github.com/omacom/omarchy-plugin-marketplace/issues/7047#issuecomment-57
    • Network accessline 102
      valid inputs as well as a single oversized input. See [stream accumulation](https://github.com/omacom/omarchy-plugin-marketplace/issues/7047#issuecomment-5735500611) and [transfer budgets](https://github.com/omacom/omarchy-plugin-marketplac
    • Network accessline 103
      See [stream accumulation](https://github.com/omacom/omarchy-plugin-marketplace/issues/7047#issuecomment-5735500611)
    • Network accessline 104
      and [transfer budgets](https://github.com/omacom/omarchy-plugin-marketplace/issues/6068#issuecomment-5735045519).
    • Network accessline 112
      signing key from that checkout retain the same problem. Authenticate final package bytes through installation, not just downloaded source. See [bootstrap re-review](https://github.com/omacom/omarchy-plugin-marketplace/issues/5371#issuecomme
    • Network accessline 114
      See [bootstrap re-review](https://github.com/omacom/omarchy-plugin-marketplace/issues/5371#issuecomment-5745040622).
    • Network accessline 124
      loopback literal. Handle redirects and resolved destinations under the same policy. Remote use requires the agreed explicit opt-in. See [local API review](https://github.com/omacom/omarchy-plugin-marketplace/issues/8352#issuecomment-5819807
    • Network accessline 125
      policy. Remote use requires the agreed explicit opt-in. See [local API review](https://github.com/omacom/omarchy-plugin-marketplace/issues/8352#issuecomment-5819807404) and [local-only leak](https://github.com/omacom/omarchy-plugin-marketpl
    • Network accessline 126
      See [local API review](https://github.com/omacom/omarchy-plugin-marketplace/issues/8352#issuecomment-5819807404) and [local-only leak](https://github.com/omacom/omarchy-plugin-marketplace/issues/8434#issuecomment-5819147536), checked 24 Sep
    • Network accessline 127
      and [local-only leak](https://github.com/omacom/omarchy-plugin-marketplace/issues/8434#issuecomment-5819147536), checked 24 September 2026. Test allowed clients, unauthenticated requests, hostile Host/Origin values and deceptive endpoint na
    • Network accessline 137
      close responses on every exit and join/reap readers within a bounded wait. Repeat cancellation with a full queue to expose retained threads and resources. See [slow reads](https://github.com/omacom/omarchy-plugin-marketplace/issues/8371#iss
    • Network accessline 138
      Repeat cancellation with a full queue to expose retained threads and resources. See [slow reads](https://github.com/omacom/omarchy-plugin-marketplace/issues/8371#issuecomment-5819019831), [git children](https://github.com/omacom/omarchy-plu
    • Network accessline 139
      See [slow reads](https://github.com/omacom/omarchy-plugin-marketplace/issues/8371#issuecomment-5819019831),
    • Network accessline 140
      [git children](https://github.com/omacom/omarchy-plugin-marketplace/issues/8392#issuecomment-5819774887)
    • Network accessline 141
      and [queue shutdown](https://github.com/omacom/omarchy-plugin-marketplace/issues/5619#issuecomment-5784771145).
    • Network accessline 145
      a pathname check followed by numeric-PID signaling can race. Prefer a suitable user service/cgroup or a race-free process handle and avoid elevating user-process cleanup. See [DevWatch](https://github.com/omacom/omarchy-plugin-marketplace/i
    • Network accessline 146
      user service/cgroup or a race-free process handle and avoid elevating user-process cleanup. See [DevWatch](https://github.com/omacom/omarchy-plugin-marketplace/issues/7927#issuecomment-5815441990) and [Phonecam](https://github.com/omacom/om
    • Network accessline 147
      cleanup. See [DevWatch](https://github.com/omacom/omarchy-plugin-marketplace/issues/7927#issuecomment-5815441990)
    • Network accessline 148
      and [Phonecam](https://github.com/omacom/omarchy-plugin-marketplace/issues/7497#issuecomment-5795173133).
    • Network accessline 156
      external Text sink to PlainText. Verify every visible button and IPC invocation uses the actual manifest ID, especially after a rename. See [Clipbar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8478#issuecomment-5819340291),
    • Network accessline 157
      uses the actual manifest ID, especially after a rename. See [Clipbar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8478#issuecomment-5819340291), [persisted location](https://github.com/omacom/omarchy-plugin-marketplace/issue
    • Network accessline 158
      See [Clipbar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8478#issuecomment-5819340291),
    • Network accessline 159
      [persisted location](https://github.com/omacom/omarchy-plugin-marketplace/issues/8395#issuecomment-5819055337)
    • Network accessline 160
      and [panel target](https://github.com/omacom/omarchy-plugin-marketplace/issues/8463#issuecomment-5819309888).
    • Network accessline 164
      Read current reviewer disposition before calling a concern a listing blocker. [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-5970593063)
    • Network accessline 165
      [Touch Bar](https://github.com/omacom/omarchy-plugin-marketplace/issues/9262#issuecomment-5970593063)
    • Network accessline 166
      and [OmaRead](https://github.com/omacom/omarchy-plugin-marketplace/issues/9174#issuecomment-5970439231)
    • Network accessline 173
      apply the policy to redirects and proxy routing too. For credential-bearing requests, prefer refusing redirects; never forward secrets to a new origin. See [Sift](https://github.com/omacom/omarchy-plugin-marketplace/issues/9858#issuecomment
    • Network accessline 174
      requests, prefer refusing redirects; never forward secrets to a new origin. See [Sift](https://github.com/omacom/omarchy-plugin-marketplace/issues/9858#issuecomment-5970803404) and [TMOS](https://github.com/omacom/omarchy-plugin-marketplace
    • Network accessline 175
      See [Sift](https://github.com/omacom/omarchy-plugin-marketplace/issues/9858#issuecomment-5970803404)
    • Network accessline 176
      and [TMOS](https://github.com/omacom/omarchy-plugin-marketplace/issues/8574#issuecomment-5823505773).
    • Network accessline 180
      state in the backend immediately before forwarding input; a masked UI field or polled password-prompt state cannot protect secrets in argv/scrollback. See [Pianobar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8898#issuecomm
    • Network accessline 181
      or polled password-prompt state cannot protect secrets in argv/scrollback. See [Pianobar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8898#issuecomment-5855383375) and its [stale prompt check](https://github.com/omacom/omarc
    • Network accessline 182
      See [Pianobar](https://github.com/omacom/omarchy-plugin-marketplace/issues/8898#issuecomment-5855383375)
    • Network accessline 183
      and its [stale prompt check](https://github.com/omacom/omarchy-plugin-marketplace/issues/8898#issuecomment-5858550108).
    • Network accessline 187
      operation, trusted helper and secret recipient to the same verified flow; names, caller-supplied command text and an arbitrary child of real sudo are insufficient. See [Doorman](https://github.com/omacom/omarchy-plugin-marketplace/issues/95
    • Dangerous shell operationline 188
      caller-supplied command text and an arbitrary child of real sudo are insufficient.
    • Network accessline 188
      caller-supplied command text and an arbitrary child of real sudo are insufficient. See [Doorman](https://github.com/omacom/omarchy-plugin-marketplace/issues/9558#issuecomment-5961920299). Loopback alone also does not isolate private history
    • Network accessline 189
      See [Doorman](https://github.com/omacom/omarchy-plugin-marketplace/issues/9558#issuecomment-5961920299). Loopback alone also does not isolate private history from other local accounts; authenticate those reads or use a suitably protected Un
    • Network accessline 190
      Loopback alone also does not isolate private history from other local accounts; authenticate those reads or use a suitably protected Unix socket. See [Umbra](https://github.com/omacom/omarchy-plugin-marketplace/issues/8928#issuecomment-5928
    • Network accessline 192
      See [Umbra](https://github.com/omacom/omarchy-plugin-marketplace/issues/8928#issuecomment-5928250307).
    • Network accessline 195
      or invoking Git; reject backup-supplied symlinks before writes. A restore must stay within the authorized plugin set. See [Settings Sync](https://github.com/omacom/omarchy-plugin-marketplace/issues/9849#issuecomment-5970334443).
    • Network accessline 196
      stay within the authorized plugin set. See [Settings Sync](https://github.com/omacom/omarchy-plugin-marketplace/issues/9849#issuecomment-5970334443). Ensure success describes the full promised state across all active providers;
    • Network accessline 197
      [Settings Sync](https://github.com/omacom/omarchy-plugin-marketplace/issues/9849#issuecomment-5970334443).
    • Network accessline 198
      Ensure success describes the full promised state across all active providers; checking only resolved cannot establish discovery is disabled if Avahi still publishes. See [Network Persona](https://github.com/omacom/omarchy-plugin-marketplace
    • Network accessline 200
      publishes. See [Network Persona](https://github.com/omacom/omarchy-plugin-marketplace/issues/9854#issuecomment-5970652519).

    skills/omarchy-service-ipc/references/service-contract.md

    • Network accessline 54
      Source: [Quattro shell contract, reviewed 29 September 2026](https://github.com/omacom/omarchy/blob/e332dc975d5f635294c497ebb54feb98dc3d89eb/docs/omarchy-shell.md).

    How the signals fit together

    Facts from a static read of the files at the pinned commit. They describe what the code does, not why.

    Some files could not be read; the facts below still hold.

    Declared and executed: 8 facts
    Signal confidence: 492 facts

    and 442 more

    Only the first 500 facts are listed.

    Works with

    Agent compatibility, from the files in this repository
    AgentStatusEvidenceInstall to
    Claude CodeNativeManifest .claude-plugin/marketplace.json.claude/skills/<skill-name>/
    CodexNativeManifest AGENTS.md.agents/skills/<skill-name>/
    CursorCompatibleStandard SKILL.md plugins/build-omarchy-plugins/skills/omarchy-bar-widget/SKILL.md.cursor/skills/<skill-name>/
    Gemini CLICompatibleStandard SKILL.md plugins/build-omarchy-plugins/skills/omarchy-bar-widget/SKILL.md.gemini/skills/<skill-name>/
    GitHub CopilotCompatibleStandard SKILL.md plugins/build-omarchy-plugins/skills/omarchy-bar-widget/SKILL.md.github/skills/<skill-name>/
    OpenCodeCompatibleStandard SKILL.md plugins/build-omarchy-plugins/skills/omarchy-bar-widget/SKILL.md.opencode/skills/<skill-name>/
    • Native The repository ships a manifest, folder or frontmatter field for this agent.
    • Compatible A standard SKILL.md that this agent can read.
    • Unknown No evidence either way.

    Derived automatically from paths, manifests and frontmatter. Not tested on each agent.

    You might also use

    mattpocock/skills

    Skills for Real Engineers. Straight from my .agents directory.

    316.1kGitHub stars

    obra/superpowers

    An agentic skills framework & software development methodology that works.

    313.3kGitHub stars

    NousResearch/hermes-agent

    The agent that grows with you

    261kGitHub stars

    multica-ai/andrej-karpathy-skills

    Behavioral guidelines to reduce common LLM coding mistakes. Use when writing, reviewing, or refactoring code to avoid overcomplication, make surgical changes, surface assumptions,…

    230.1kGitHub stars

    anthropics/skills

    Public repository for Agent Skills

    188kGitHub stars

    DietrichGebert/ponytail

    Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.

    185.6kGitHub stars