I've taken the habit of running any repo I encounter through my clanker. This is what he found: # Security Review – Omalauncher **Repository:**

GitHub

GitHub - SimonSchubert/omalauncher: Agentic Android launcher: build your own apps and widgets with AI agents, Omarchy themes, Arch Linux without root

Agentic Android launcher: build your own apps and widgets with AI agents, Omarchy themes, Arch Linux without root - SimonSchubert/omalauncher

**Review type:** Preliminary static source-code analysis After reviewing the source code, I identified a few potential security issues worth addressing. ### 1. Insecure Arch Linux Rootfs Download – Critical **File:** `linux/Bootstrap.kt` The Arch Linux root filesystem is downloaded over unencrypted HTTP: `http://os.archlinuxarm.org/os/ArchLinuxARM-aarch64-latest.tar.gz` No cryptographic signature or checksum verification appears to be performed before extraction. An attacker capable of intercepting network traffic could potentially replace the archive with malicious content, compromising the Linux environment. **Recommendation:** Use HTTPS where available and verify the rootfs against a trusted cryptographic signature or pinned checksum. ### 2. Potential TAR Path Traversal – High **File:** `linux/Bootstrap.kt` During extraction, archive entry paths are joined directly to the destination directory without canonical-path containment checks. Malicious entries containing `../`, absolute paths, or crafted symbolic links could potentially write files outside the intended rootfs directory, within the app's accessible filesystem. **Recommendation:** Validate every extraction path and link target, rejecting entries that escape the designated root directory. ### 3. Additional Security Considerations - OWL widgets can execute shell commands, making untrusted widgets a potential attack surface. - Cleartext network traffic is permitted at the application level. - External scripts and binaries should undergo appropriate integrity verification before execution. ### Conclusion I found no evidence of intentionally malicious behavior during this review. However, the rootfs download and archive extraction mechanisms present significant potential security risks. **I recommend addressing these issues before relying on the Linux environment for sensitive workloads.** This is a preliminary source-code review, not a full security audit. No exploit testing or APK binary verification was performed.