Pywayne Visualization Rerun Utils

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Using the skill may fetch and run third-party visualization code, so the package source and version matter.

Why it was flagged

The skill discloses that use depends on a third-party SDK that may be downloaded through gettool, while no install specification or pinned source is provided in the artifacts.

Skill content

- **Dependencies**: Requires Rerun SDK (auto-downloaded via `gettool`)

Recommendation

Verify the Rerun SDK/gettool source and version before use, and prefer pinned or trusted package sources where possible.

NoteHigh Confidence

ASI05: Unexpected Code Execution

What this means

Running the documented setup may open or start a local Rerun viewer.

Why it was flagged

The example initializes Rerun with spawning enabled, which can start a local viewer process. This is expected for visualization but should be deliberate.

Skill content

rr.init('my_app', spawn=True)

Recommendation

Use this in an environment where launching the viewer is acceptable, and adjust Rerun initialization options if you do not want a spawned viewer.