vfx-oiio
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The Python script
scripts/oiio.pyserves as a wrapper for local OpenImageIO binaries (oiiotool,iinfo,idiff, etc.). It utilizessubprocess.callwith arguments passed as a list rather than a shell string, effectively mitigating shell injection risks. The script also includes a--dry-runmode for auditing commands before execution. - [SAFE]: No remote dependencies or external code downloads are performed. The skill assumes the necessary OpenImageIO tools are pre-installed on the host system as per standard VFX pipeline requirements.
- [SAFE]: The skill does not contain hardcoded credentials, sensitive file access, or data exfiltration patterns. Environment manipulation is limited to setting the
OCIOvariable for color management, which is standard behavior for the intended use case. - [SAFE]: No obfuscation, persistence mechanisms, or privilege escalation attempts were found in the instructions or the supporting scripts.
Audit Metadata