wondershot

Permissions

4 permissions weaken the sandbox. Flatsonar asks before installing.

• all devices (/dev): webcams, disks, raw hardware

  --device=all
• sandbox escape: can run commands on the host via flatpak-spawn

  --talk-name=org.freedesktop.Flatpak
• wildcard own-name org.kde.*: can impersonate system services

  --own-name=org.kde.*
• full access to your home folder

  --filesystem=home
• inter-process communication (needed for X11)

  --share=ipc
• network

  --share=network
• Wayland display

  --socket=wayland
• X11 display, only when Wayland is unavailable

  --socket=fallback-x11
• access to xdg-run/pipewire-0

  --filesystem=xdg-run/pipewire-0
• audio

  --socket=pulseaudio
• talks to org.kde.KWin

  --talk-name=org.kde.KWin
• portal Desktop

  --talk-name=org.freedesktop.portal.Desktop
• portal OpenURI

  --talk-name=org.freedesktop.portal.OpenURI
• system tray

  --talk-name=org.kde.StatusNotifierWatcher
• talks to org.freedesktop.StatusNotifierWatcher

  --talk-name=org.freedesktop.StatusNotifierWatcher

Who publishes this

The creator demonstrably controls this app id: Flathub verification, the hosting account owns the namespace, or a well-known file on their domain.

• installs a prebuilt binary instead of building from source

  source:prebuilt
• hosted by github.com/jackmusick, which owns the io.github namespace of io.github.jackmusick.wondershot

  publisher:namespace

Maintenance

Recent activity on the upstream repository, or built and reviewed by Flathub.

No staleness signals: recent activity, or built and reviewed by Flathub.