[Plugin]:menu-stats

[mikevalstar]

Repository URL

https://github.com/mikevalstar/menu-stats

Category

System

Tags

Bar, Quickshell, System

Suggest a missing tag

No response

Maintainer notes

No notes,

a simple intitial setup can be:

{
          "id": "valstar.menu-stats",
          "items": [
            {
              "metric": "cpu",
              "style": "graph"
            },
            {
              "metric": "memory",
              "style": "meter"
            },
            {
              "metric": "network",
              "style": "text"
            },
            {
              "metric": "disk",
              "style": "graph"
            }
          ],
          "showIcons": true
        }

Submission checklist

• The repository is public and contains installation and removal instructions.
• I have documented the plugin license and any external dependencies.
• I confirm that I own or have permission to submit this plugin and its preview assets.
• The plugin does not overwrite user configuration without explicit consent.
• I understand that approval is for listing and is not a security review.

[github-actions]

Marketplace validation

✅ Repository is public and reachable: mikevalstar/menu-stats
✅ Found 1 valid, uniquely identified plugin manifest
✅ Root README and license files detected
✅ Quattro compatibility passed at commit b38c83a
✅ Optional root preview detected

• valstar.menu-stats — Menu Stats 0.2.0 (manifest.json)

Ready for listing review. Validation checks this commit’s structure and Quattro compatibility; it is not a security review.

[HANCORE-linux]

At exact reviewed commit b38c83a69e9e1c3fb414b80264b034f8a8f03f9c, approval is blocked: samplers/ProcessSampler.qml:51-57 repeatedly starts PATH-resolved sh -c over an unbounded /proc/[0-9]*/stat glob and buffers all stdout, but has no byte cap, hard deadline, or process-tree cleanup; samplers/DiskSampler.qml:110-117 and samplers/GpuSampler.qml:273-283 also use inherited-PATH, uncapped producers (the GPU command can run every 250 ms). lib/Metrics.js:72-86 additionally accepts unbounded settings-item cardinality and source-string length that feed multiple UI Repeaters and sampler state, so crafted shell settings can exhaust shell resources; please bound producer output/lifetimes and settings collection/string sizes.

[github-actions]

Automated security baseline

✅ Automated security baseline passed at commit b38c83a….

No action is required.

This deterministic baseline detects only its documented patterns and is not designed to stop a motivated attacker.

This is not a security audit, certification, warranty, or endorsement.