vfx-oiio

Pass

Audited by Gen Agent Trust Hub on Jun 27, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The Python script scripts/oiio.py serves as a wrapper for local OpenImageIO binaries (oiiotool, iinfo, idiff, etc.). It utilizes subprocess.call with arguments passed as a list rather than a shell string, effectively mitigating shell injection risks. The script also includes a --dry-run mode for auditing commands before execution.
  • [SAFE]: No remote dependencies or external code downloads are performed. The skill assumes the necessary OpenImageIO tools are pre-installed on the host system as per standard VFX pipeline requirements.
  • [SAFE]: The skill does not contain hardcoded credentials, sensitive file access, or data exfiltration patterns. Environment manipulation is limited to setting the OCIO variable for color management, which is standard behavior for the intended use case.
  • [SAFE]: No obfuscation, persistence mechanisms, or privilege escalation attempts were found in the instructions or the supporting scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 27, 2026, 09:54 AM
Security Audit — agent-trust-hub — vfx-oiio