OpenEXR

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:31 AM UTC
• Version: 0.1.1

Overview

The skill does what it says, but it pins a known-vulnerable EXR parser that is directly exposed to files the user opens.

Review before installing. Use an isolated virtual environment and avoid opening untrusted EXR files unless the OpenEXR pin is updated to a patched compatible release and numpy/Pillow are locked with reviewed versions and hashes. The concern is supply-chain and parser safety, not evidence of intentional malware.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unverified Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-3
Vulnerability Type: Insecure dependency resolution and missing integrity verification
Risk Level: Medium

Complete Code Snippet

text

OpenEXR==3.2.4
numpy<2
Pillow

The installation workflow is documented in SKILL.md:18-22:

bash

pip install -r requirements.txt

Technical Analysis

The dependency manifest does not provide a reproducible or integrity-verified dependency set:

• numpy<2 permits the package resolver to select any available release below version 2.
• Pillow has no version constraint.
• No package is protected by an expected cryptographic hash.
• Transitive dependencies are not locked.

Consequently, the code installed by this workflow can change without a corresponding change to the audited project. Installation may also execute package build or installation logic with the privileges of the user running pip.

This finding concerns mutable and unverified supply-chain inputs. The audit did not find evidence that the named dependencies are intentionally malicious or that this project performs dependency confusion or typosquatting.

Attack Path

1. A user follows the setup instructions and runs pip install -r requirements.txt.
2. pip contacts its configured package index and dynamically resolves the unconstrained or partially constrained packages.
3. An attacker compromises a permitted release, package-index account, distribution artifact, or configured package source.
4. Because no hashes are specified, pip accepts the altered artifact if ordinary index and transport validation succeeds.
5. Malicious installation hooks, native components, or subsequently imported package code execute in the local Python environment.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user performing the installation or running the EXR utility. Depending on those privileges and the host environment, ...[truncated 399 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact, reviewed version, including numpy and Pillow.
2. Resolve and lock all transitive dependencies for each supported Python version and platform.
3. Record SHA-256 hashes for every permitted distribution and require verification during installation:

bash

python -m pip install --require-hashes -r requirements.txt

4. Generate the locked manifest through a controlled process, such as pip-compile --generate-hashes, and review updates before merging them.
5. Prefer binary wheels from a trusted, explicitly configured package index. Restrict fallback to untrusted or unintended indexes.
6. Install into an isolated virtual environment under a non-privileged account rather than using system Python or administrative privileges.
7. Add automated dependency vulnerability and provenance checks to the release process.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Known Vulnerable Dependency: OpenEXR==3.2.4 — 14 advisory(ies): CVE-2025-64183 (OpenEXR has use after free in PyObject_StealAttrString); CVE-2026-34588 (OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write); CVE-2026-27622 (OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write) +11 more

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

OpenEXR==3.2.4 is explicitly pinned to a version with numerous published advisories, including memory corruption and out-of-bounds read/write issues. This skill's purpose is to open and process EXR files, so a vulnerable EXR parser is directly exposed to attacker-supplied files, making denial of service and possible memory-safety exploitation materially more dangerous in context.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/exr_extract.py (reported line 585)May include surrounding context.

python

help="Input color space: acescg (default), linear, srgb",
    )
    p_beauty.add_argument("--output-dir", default=None, help="Output directory")
    p_beauty.add_argument("--force", action="store_true", help="Overwrite existing files")

    # --- crypto ---
    p_crypto = sub.add_parser("crypto", help="Extract cryptomatte as colored segmentation PNG")

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/exr_extract.py (reported line 610)May include surrounding context.

python

help="Input color space: acescg (default), linear, srgb",
    )
    p_beauty.add_argument("--output-dir", default=None, help="Output directory")
    p_beauty.add_argument("--force", action="store_true", help="Overwrite existing files")

    # --- crypto ---
    p_crypto = sub.add_parser("crypto", help="Extract cryptomatte as colored segmentation PNG")

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/exr_extract.py (reported line 624)May include surrounding context.

python

help="Input color space: acescg (default), linear, srgb",
    )
    p_beauty.add_argument("--output-dir", default=None, help="Output directory")
    p_beauty.add_argument("--force", action="store_true", help="Overwrite existing files")

    # --- crypto ---
    p_crypto = sub.add_parser("crypto", help="Extract cryptomatte as colored segmentation PNG")

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 82% confidence

Finding

numpy is only constrained as <2, so dependency resolution may select a wide range of versions, some of which may carry known vulnerabilities. While NumPy is not the primary file parser here, it often processes attacker-influenced image data sizes and buffers, so version ambiguity creates avoidable supply-chain and stability risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Pillow is left unpinned, so installs may resolve to different versions over time, including versions with known security flaws or breaking changes. In an EXR/image-processing skill that parses potentially untrusted image inputs, dependency drift increases the chance of introducing a vulnerable parser into the runtime.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

OpenEXR==3.2.4
numpy<2
Pillow

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Pillow has known historical vulnerabilities, and because it is unpinned there is no assurance the installed version is safe. Given this skill handles image conversion and batch processing, Pillow may end up decoding or transforming untrusted image data, so an unsafe version could expose the environment to parser bugs or resource exhaustion.

Content

No source excerpt is available for this finding.