Oiiotool

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:30 AM UTC
• Version: 0.1.1

Overview

This is a local image-processing skill with ordinary tool and dependency risks, but no evidence of hidden, deceptive, persistent, or malicious behavior.

Install this in a virtual environment, pin OpenImageIO and Pillow if you need reproducible builds, keep originals before using lossy compression, and check output paths before running the video helper because it can overwrite an existing MP4.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19
• Finding: Unpinned Third-Party Runtime Dependency## Vulnerability Details **File Location**: `SKILL.md:19-23` **Vulnerability Type**: Unpinned dependency installation without integrity verification **Risk Level**: Medium ```bash ## Setup ```bash pip install openimageio ``` ``` ### Technical Analysis The documented installation procedure retrieves the currently available `openimageio` package and its transitive dependencies without specifying an exact version, trusted artifact hash, or dependency lockfile. The effective installed code can therefore change after this skill has been audited. Because Python packages may execute installation or imported runtime code with the invoking user's permissions, compromise of the upstream package, its distribution account, package index resolution, or a transitive dependency could introduce unreviewed code into the local environment. This also prevents reproducible installation and makes it difficult to verify dependency provenance. The exposure sweep script additionally imports Pillow, but the setup instructions do not pin or explicitly install a reviewed Pillow version. ### Attack Path 1. A user follows the setup documentation and runs `pip install openimageio`. 2. `pip` resolves whichever package and transitive dependency versions are available at that time. 3. An upstream package release, distribution account, dependency, or resolved artifact has been compromised or contains malicious installation/runtime code. 4. `pip` downloads and installs the affected artifact without checking a project-supplied cryptographic hash. 5. The malicious code executes during installation or when the installed component is invoked by the skill. This exploitation path depends on compromise or unsafe modification of an upstream dependency; the audited project itself does not retrieve a separate remote payload at runtime. ### Impact Assessment Malicious dependency code could execute with the privileges of the user performing the installat ...[truncated 476 chars]
• Remediation: ## Remediation Suggestions 1. Create a reviewed dependency lockfile containing exact versions for OpenImageIO, Pillow, and all required transitive dependencies. 2. Record cryptographic hashes for every permitted distribution artifact and install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Generate the lockfile for each supported Python version and platform because OpenImageIO commonly relies on platform-specific wheels. 4. Configure installation to use an explicitly trusted package index or an internally controlled artifact repository. 5. Verify downloaded artifacts before promoting them into the trusted repository. 6. Add automated dependency vulnerability and provenance scanning to the release process. 7. Document installation inside an isolated virtual environment under a non-privileged account. 8. Explicitly declare Pillow, which is imported by `scripts/exposure_sweep.py`, rather than relying on an undeclared environment dependency.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs use of shell-capable tooling (`oiiotool`, `python`, and optionally `ffmpeg`) and file access, but it does not declare any explicit `permissions` or `allowed-tools` scope. That creates an authorization gap where an agent may invoke broader shell/file capabilities than the skill actually needs, increasing the chance of unintended command execution or file access if user-controlled filenames, paths, or arguments are later incorporated into commands.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_oiiotool(args):
    """Run oiiotool with the given arguments. Returns True on success."""
    cmd = ["oiiotool"] + args
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"oiiotool error: {result.stderr.strip()}", file=sys.stderr)
        return False

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_oiiotool(args):
    """Run oiiotool with the given arguments. Returns True on success."""
    cmd = ["oiiotool"] + args
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"oiiotool error: {result.stderr.strip()}", file=sys.stderr)
        return False

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

seq["directory"],
            f"{seq['prefix']}{seq['separator']}{str(seq['start']).zfill(seq['padding'])}.exr",
        )
        result = subprocess.run(
            ["oiiotool", "--info", "-v", first_exr],
            capture_output=True, text=True,
        )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The ffmpeg command includes -y, which forces overwrite of the output file without confirmation. If the user supplies an existing path via --output, or the default output name collides with an existing file, the script can silently destroy data; in an agent or automated workflow, that makes accidental data loss more likely.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: This markdown file includes a workflow that converts an EXR to lossy DWAA compression and explicitly notes it makes files much smaller, but it does not warn that this is a lossy, potentially irreversible quality change. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or integrity.

Static analysis

No suspicious patterns detected.