OpenEXR

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill may add third-party Python packages to the user's environment.

Why it was flagged

The skill relies on external Python packages; OpenEXR is pinned, but numpy is only range-bounded and Pillow is unpinned. This is normal for a Python image-processing skill but worth noticing before installation.

Skill content

OpenEXR==3.2.4
numpy<2
Pillow

Recommendation

Install in a virtual environment or isolated project environment, and use trusted package indexes when installing dependencies.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

A mistaken directory or `--force` option could create many files or overwrite existing generated PNG outputs.

Why it was flagged

The tool can batch-process local directories and can overwrite existing outputs when `--force` is used. This is disclosed and purpose-aligned, but users should confirm output paths before running it.

Skill content

All subcommands accept a directory path to process every EXR in it... Existing outputs are skipped unless `--force` is specified.

Recommendation

Use an explicit output directory, review the target path, and only use `--force` when overwriting outputs is intended.