PrimoGameStudio's omacom/omarchy-plugin-marketplace#13628 remains open. Follow-ups removed raw application identities from automatic icon paths, passed restore arguments as data, and replaced an eval-based webapp launch route.
HANCORE-linux confirmed the webapp fix but identified another path at the latest target: an unknown pinned application's client-supplied identity could still reach a shell after the user closed and relaunched it. omacom/omarchy-plugin-marketplace#13628:issuecomment-6618047712 leaves approval withheld. The finding describes conditional execution as the desktop user, based on static review, with no root or zero-click claim.
