make-a-woke-profile-with-chatgpt

• Outcome: Review
• Latest audit: Nov 13, 2026 · 9:38 AM UTC
• Version: 1.0.5

Overview

ClawScan marks this skill suspicious because it reports privacy, permission, install-version, and file-deletion concerns, and analysis of one script was partial; this is not a finding of malicious intent.

Review the privacy and permission concerns before installing, and consider whether you are comfortable sending a selfie and personal details to external services. The scanner also reports an unpinned installer and a deletion risk for an existing `_frames` directory. Treat the review as incomplete: one script was only partially inspected, so the scan cannot rule out issues in the unevaluated text.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (18)

Tainted flow: 'r' from os.environ.get (line 43, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/wokify.py (reported line 44)May include surrounding context.

python

for attempt in range(6):
        try:
            r = urllib.request.Request(API + path, data=data, headers=h, method=method)
            return json.load(urllib.request.urlopen(r, timeout=180))
        except urllib.error.HTTPError as e:
            msg = e.read().decode()[:800]
            if e.code in (429, 500, 502, 503, 504) and attempt < 5:

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: make-a-woke-profile-with-chatgpt
description: >-
  Turn one selfie into a satirical "I MADE ME WOKE" profile set with GPT Image 2.6, the image
  model in ChatGPT (aka Wokify): 11 woke versions of you (character sheet, woke friends photo,
  LinkedIn-style profile, DEI video call, protest TV interview, action figure, holographic trading
  card, woke cat, oat latte, "In this house" home, WOKEOPOLY), four as looping GIFs, in a 4:5
  collage sized for X plus an MP4, and an optional HyperFrames presenter-mode video. One command on
  varg, about $0.78; the prompts also work pasted into ChatGPT. Use when someone wants to make
  thems

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

6. **Optional: the presenter-mode video.** `python3 scripts/presenter.py wokify-out --music bed.mp3`

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

- `scripts/presenter.py`: the presenter-mode slideshow video as a HyperFrames project.

Code capability 'env' detected in scripts/wokify.py but not covered by declared permissions.

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.

Content

No source excerpt is available for this finding.

Code capability 'network' detected in scripts/wokify.py but not covered by declared permissions.

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.

Content

No source excerpt is available for this finding.

Tainted flow: 'r' from open (line 53, file read) → urllib.request.urlopen (network output)

High

• Category: Data Flow
• Confidence: 80% confidence

Finding

File contents flow to a network sink. This may indicate data exfiltration of sensitive files.

Content

Scanner excerpt · scripts/wokify.py (reported line 54)May include surrounding context.

python

def download(url, path):
    r = urllib.request.Request(url, headers={"User-Agent": UA})
    with urllib.request.urlopen(r, timeout=180) as resp, open(path, "wb") as f:
        shutil.copyfileobj(resp, f)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 8)May include surrounding context.

odel in ChatGPT (aka Wokify): 11 woke versions of you (character sheet, woke friends photo, LinkedIn-style profile, DEI video call, protest TV interview, action figure, holographic trading card, woke cat, oat latte, "In this house" home, WOKEOPOLY), four as looping GIFs, in a 4:5 collage sized for X plus an MP4, and an optional HyperFrames presenter-mode video. One command on varg, about $0.78; the prompts also work pasted into ChatGPT. Use when someone wants to make themselves woke, wokify a photo or profile picture, a woke AI filter, the "I made me woke" trend, a ChatGPT image prompt pack for a selfie, an AI action figure or trading card of themselves, or a collage of AI versions of one person. Not for photos of others without consent, public figures, or mocking LGBTQ+ people themselves (the joke is on performative habits and brands).

bash

npx skills add vargHQ/skills --skill make-a-woke-profile-with-chatgpt                # Claude Code, Codex, Cursor, Grok, Gemini CLI, OpenCode…

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

varg, about $0.78; the prompts also work pasted into ChatGPT. Use when someone wants to make
  themselves woke, wokify a photo or profile picture, a woke AI filter, the "I made me woke" trend,
  a ChatGPT image prompt pack for a selfie, an AI action figure or trading card of themselves, or a
  collage of AI versions of one person. Not for photos of others without consent, public figures,
  or mocking LGBTQ+ people themselves (the joke is on performative habits and brands).
license: MIT
metadata:

The selfie-generation workflow lacks an explicit warning that the user's photo is sent to external services.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The skill instructs users to transform a personal selfie through varg and a hosted image model, but does not explicitly disclose that the photo leaves the user's device for external processing. Listing the API and model under 'Uses' does not clearly warn users about this privacy-relevant transfer.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The installation command executes the unpinned npm package skills, allowing the executable version to change between installations. Although this is an installer rather than an MCP server, a compromised future release could execute code with the user's permissions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

The workflow instructs users to upload an identifiable selfie without a privacy warning about third-party processing.

Medium

• Category: Output Handling
• Confidence: 92% confidence

Finding

The instructions explicitly tell users to attach a selfie to ChatGPT and include their name and pronouns in the prompt. The file does not warn that these identifiable images and personal details will be sent to an external service or explain the associated privacy implications.

Content

No source excerpt is available for this finding.

Animation mode silently deletes any existing `_frames` directory and its contents.

Medium

• Category: Output Handling
• Confidence: 99% confidence

Finding

Animation mode recursively removes an existing _frames directory beneath the selected output folder without checking ownership or asking permission. Reusing a folder containing unrelated files under that name can permanently destroy them, even though the deletion is bounded to that subdirectory.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/collage.py (reported line 142)May include surrounding context.

python

for i in range(fps * sec):
            compose(i * 1000 / fps).resize((1200, 1500), Image.LANCZOS).save(f"{fd}/{i:04d}.png")
        mp4, gif = os.path.join(a.out, "collage.mp4"), os.path.join(a.out, "collage.gif")
        subprocess.run(["ffmpeg", "-y", "-loglevel", "error", "-framerate", str(fps), "-i", f"{fd}/%04d.png", "-c:v", "libx264",
                        "-pix_fmt", "yuv420p", "-crf", "18", "-preset", "slow", "-movflags", "+faststart", mp4], check=True)
        subprocess.run(["ffmpeg", "-y", "-loglevel", "error", "-framerate", str(fps), "-i", f"{fd}/%04d.png", "-vf",
                        "fps=8,scale=720:900:flags=lanczos,split[a][b];[a]palettegen=max_colors=256:stats_mode=diff[p];[b][p]paletteuse=dither=sierra2_4a:diff_mode=rectangle",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/collage.py (reported line 144)May include surrounding context.

python

mp4, gif = os.path.join(a.out, "collage.mp4"), os.path.join(a.out, "collage.gif")
        subprocess.run(["ffmpeg", "-y", "-loglevel", "error", "-framerate", str(fps), "-i", f"{fd}/%04d.png", "-c:v", "libx264",
                        "-pix_fmt", "yuv420p", "-crf", "18", "-preset", "slow", "-movflags", "+faststart", mp4], check=True)
        subprocess.run(["ffmpeg", "-y", "-loglevel", "error", "-framerate", str(fps), "-i", f"{fd}/%04d.png", "-vf",
                        "fps=8,scale=720:900:flags=lanczos,split[a][b];[a]palettegen=max_colors=256:stats_mode=diff[p];[b][p]paletteuse=dither=sierra2_4a:diff_mode=rectangle",
                        "-loop", "0", gif], check=True)
        shutil.rmtree(fd)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/presenter.py (reported line 83)May include surrounding context.

python

if not shutil.which("ffmpeg"):
        sys.exit("--music needs ffmpeg")
    a = ROOT / "assets" / "audio"
    subprocess.run(["ffmpeg", "-loglevel", "error", "-y", "-f", "lavfi", "-i", "sine=frequency=1900:duration=0.07", "-f", "lavfi", "-i",
                    "anoisesrc=d=0.03:c=pink:a=0.3", "-filter_complex", "[0]afade=t=out:st=0:d=0.07,volume=0.35[a];[1]highpass=f=3000,afade=t=out:st=0:d=0.03[b];[a][b]amix=inputs=2:normalize=0",
                    str(a / "tick.wav")], check=True)
    cuts = [9000 + 3000 * i for i in range(11)]   # slide changes, ms

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/presenter.py (reported line 89)May include surrounding context.

python

cuts = [9000 + 3000 * i for i in range(11)]   # slide changes, ms
    fc = f"[1]asplit={len(cuts)}" + "".join(f"[k{i}]" for i in range(len(cuts))) + ";" + "".join(f"[k{i}]adelay={c}|{c}[t{i}];" for i, c in enumerate(cuts))
    fc += "[0]" + "".join(f"[t{i}]" for i in range(len(cuts))) + f"amix=inputs={len(cuts) + 1}:normalize=0:duration=first,atrim=0:42"
    subprocess.run(["ffmpeg", "-loglevel", "error", "-y", "-i", A.music, "-i", str(a / "tick.wav"), "-filter_complex", fc, "-c:a", "libmp3lame", "-b:a", "192k", str(a / "mix.mp3")], check=True)
    AUDIO = '      <audio id="music" class="clip" src="assets/audio/mix.mp3" data-start="0" data-duration="42.0" data-track-index="20" data-volume="0.9"></audio>\n'

# ------------------------------------------------------------------ the HyperFrames scenes