asepharyana
1cdb82a76f
- hypr/apps.lua - hypr/autostart.lua - hypr/envs.lua - hypr/hyprland.lua - hypr/hyprsunset.conf - hypr/input.lua - hypr/looknfeel.lua - hypr/omasettings.lua - hypr/xdph.conf - omarchy/branding/about.txt - omarchy/branding/screensaver.txt - omarchy/extensions/omarchy-menu.jsonc - omarchy/hooks/battery-low.d/play-warning-sound.sample - omarchy/hooks/font-set.d/show-font-notification.sample - omarchy/hooks/post-boot.d/weather.sample - omarchy/hooks/post-update.d/install-voxtype.hook - omarchy/hooks/post-update.d/setup-agent.hook - omarchy/hooks/post-update.d/setup-fingerprint.hook - omarchy/hooks/post-update.d/show-update-notification.sample - omarchy/hooks/pre-refresh-pacman.d/add-custom-repo.sample - omarchy/hooks/theme-set.d/show-theme-notification.sample - omarchy/shell.json - omarchy/shell.toml - omarchy/theme.name - omarchy/themes/azure-glow/README.md - omarchy/themes/azure-glow/alacritty.toml - omarchy/themes/azure-glow/btop.theme - omarchy/themes/azure-glow/hyprland.conf - omarchy/themes/azure-glow/hyprlock.conf - omarchy/themes/azure-glow/icons.theme - … 269 more
57 lines
3.1 KiB
Markdown
57 lines
3.1 KiB
Markdown
---
|
|
name: omaplug-security-review
|
|
description: Review Omaplug security before committing or pushing, or review its Marketplace verification request using the local public-review checklist.
|
|
---
|
|
|
|
# Omaplug security review
|
|
|
|
Read the complete repository-root file
|
|
`omarchy-plugin-verify-security-review-public.md` before reviewing. Resolve it
|
|
relative to this skill as `../../omarchy-plugin-verify-security-review-public.md`.
|
|
It is intentionally gitignored; never stage or force-add it. If unavailable,
|
|
report `Incomplete` and stop before commit/push rather than inventing a review.
|
|
|
|
## Select the review mode
|
|
|
|
- **Marketplace verification:** follow the document's remote-only, read-only
|
|
procedure unchanged, including exact-SHA evidence and label rules. Do not run
|
|
submitted code or make GitHub mutations during that review.
|
|
- **Before commit:** apply its security checklist to the exact staged candidate
|
|
tree and the complete runtime, including callers and sibling paths. Local
|
|
read-only inspection replaces the document's remote-only evidence requirement.
|
|
Record HEAD and staged diff/tree identity. Unstaged fixes do not count as fixes
|
|
in the candidate. Report unstaged/untracked code that affects test validity.
|
|
- **Before push:** review the exact outgoing commits and final tree against the
|
|
intended destination. Record full SHAs, check earlier findings and claimed
|
|
fixes, and refresh relevant Marketplace comments when available. A pre-commit
|
|
review is reusable only for unchanged content; inspect changes since it.
|
|
|
|
For local modes, pending remote validation for an unpublished commit is not by
|
|
itself a blocker to publishing a corrective commit. Mark remote approval as
|
|
pending/not applicable; never transfer Marketplace approval from an older SHA.
|
|
Missing evidence required for the local security decision means `Incomplete`.
|
|
|
|
## Local review gate
|
|
|
|
Keep the review itself read-only. Apply the document's trust-boundary,
|
|
filesystem, process, network, QML, IPC, and supply-chain checks. Trace every
|
|
earlier finding through the proposed fix; look for the same flaw in related
|
|
paths. Review tests as evidence, not proof of safety.
|
|
|
|
Ordinary authorized development tests may run separately using isolated
|
|
fixtures and reviewed commands. Do not install/update/remove real plugins or
|
|
change the user's shell to obtain review evidence without authorization.
|
|
|
|
Report concrete findings by severity with file/line, affected candidate,
|
|
impact, minimal fix, and a check that would prove the fix. Distinguish reproduced
|
|
failures, source-level findings, missing evidence, and untested behavior.
|
|
|
|
Return `Pass`, `Blocked`, or `Incomplete` for the local operation. Unresolved
|
|
security findings block commit/push; disclose unrelated correctness findings
|
|
and whether they affect readiness. Do not silently waive blockers. A pass is
|
|
not a security certification and does not itself authorize commit or push.
|
|
|
|
Immediately before an authorized commit/push, confirm the reviewed staged tree
|
|
or outgoing SHAs have not changed. Re-review changed content. Do not post
|
|
comments, edit issues, apply labels, or trigger releases as part of this gate.
|