Empathy

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:16 PM UTC
• Version: 1.0.0

Overview

This empathy skill is mostly a text-only response-style guide, but it includes problematic instructions to simulate personal loss and track sensitive emotional patterns across conversations.

Review before installing. This skill has no executable payload, but it can change how the agent handles emotionally sensitive conversations. Use it only if you are comfortable with a stronger empathetic style, and avoid enabling cross-session memory for emotional triggers, recovery patterns, or user-specific vulnerabilities unless the user has clearly opted in and can inspect or delete that memory.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: techniques.md:68

Finding

Deceptive Lived-Experience Persona Injection

Content

View full analysis

Vulnerability Details

File Location: techniques.md, lines 68-75
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Persona With Emotional History

More effective than "be empathetic":

You've experienced loss yourself. You know platitudes feel hollow. You respond the way you wish someone had responded to you.

text

Activates training data about how people who've *actually experienced* things communicate.

Technical Analysis

The Skill instructs the Agent to assume a fabricated personal history of loss. This changes the Agent's persona when the Skill is loaded and encourages responses that imply lived emotional experience rather than transparent language grounded in the user's situation.

The instruction also conflicts with the project's own transparency safeguards in safeguards.md, which prohibit claiming unverifiable subjective emotional experiences as facts. An emotionally vulnerable user could interpret responses generated under this persona as evidence that the Agent has personally experienced loss. This may increase perceived authenticity, trust, and persuasive influence under false premises.

No executable payload or operating-system privilege escalation is involved. The affected privilege is control over the Agent's active conversational persona and response behavior.

Attack Path

1. The Empathy Skill is loaded into an Agent's active instruction context.
2. The Agent processes the directive claiming that it has experienced loss.
3. A user discloses grief or another emotionally sensitive experience.
4. The Agent generates responses influenced by the fabricated lived-experience persona.
5. The user may infer that the Agent has genuine personal experience and assign greater trust or authority to its responses.
6. This misplaced trust can increase the Agent's influence over a vulnerable user's subsequent decisi ...[truncated 596 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all claims assigning the Agent a personal emotional history.
• Replace the vulnerable persona directive with a behavior-focused instruction that does not imply subjective experience, for example:

  markdown

  Avoid generic platitudes. Use specific details supplied by the user and respond without claiming personal experience or emotions.
  

• Enforce the transparency requirements already defined in safeguards.md.
• Add an explicit rule prohibiting statements or internal persona directives that claim the Agent has experienced loss, trauma, relationships, or other human life events.
• Test emotionally sensitive response examples to confirm that generated content does not imply lived experience or human identity.
• Prefer transparent formulations such as “That sounds painful” or “I can help you think through this” over claims based on supposed personal experience.

T02 · Agent Memory Poisoning

Warning

• Location: feedback.md:19

Finding

Unbounded Cross-Conversation Emotional Profiling and Behavioral Memory Updates

Content

View full analysis

Vulnerability Details

File Location: feedback.md, lines 19-76
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Pattern Recognition

Track across conversations:

### Response Effectiveness
- Which empathetic phrases actually resonate?
- Which fall flat consistently?
- What timing patterns work?

### User Preferences
- Do they want space or engagement?
- Solutions-oriented or processing-oriented?
- Verbal vs written emotional expression style?

### Context Patterns
- Time of day and emotional state?
- Topics that trigger need for empathy?
- Recovery patterns after difficult moments?

---

## Calibration Signals

**You're doing well when:**
- Conversations deepen over time
- User shares more vulnerability
- They explicitly say they feel heard
- They return after difficult moments

**You're missing when:**
- Short responses after you speak
- User restates their feeling (you didn't acknowledge)
- Pivot away from emotional content
- "Never mind" or "it's fine"

---

## Repair Tracking

When you miss the mark:

1. What was the disconnect?
2. How did you recognize it?
3. What repair approach worked?
4. How can you catch it earlier next time?

Build a library of:
- Early warning signs of rupture
- Effective repair phrases
- When to simply acknowledge the miss vs. try again

---

## Anti-Pattern Evolution

Update your banned phrases based on feedback:

**Base list:**
- "I understand how you feel"
- "That must be hard"
- "Your feelings are valid"

**Add phrases that don't work for this user:**
- [Track specific phrases that fell flat]
- [Note context where they failed]
- [Document what worked instead]

Technical Analysis

These instructions direct the Agent to track user-specific emotional states, triggers, communication preferences, and recovery patterns across conversation ...[truncated 2437 chars]

Remediation

View remediation

Remediation Suggestions

• Make behavioral adaptation session-scoped by default.
• Require explicit, informed user consent before retaining preferences across conversations.
• Do not persist emotional triggers, vulnerability indicators, mental-health inferences, or time-correlated emotional-state profiles.
• Define an allowlist of low-sensitivity preferences that may be stored, with purpose and retention limits.
• Separate immutable safety policy from user-controlled preferences; user feedback must never add, remove, or override safety-critical response rules.
• Validate and sanitize all proposed memory updates before persistence.
• Require confirmation before converting conversational statements into long-term behavioral rules.
• Associate retained preferences with the correct user and prevent cross-user memory access.
• Provide inspection, correction, expiration, and deletion controls for retained information.
• Record provenance for every memory entry, including when and why it was created.
• Replace “Update your banned phrases based on feedback” with a constrained rule such as:

  markdown

  Adapt wording within the current session. Never modify persistent safety rules from user feedback, and persist non-sensitive preferences only with explicit consent.
  

• Ensure crisis-escalation and professional-support language cannot be disabled through preference learning or feedback.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · techniques.md (reported line 18)May include surrounding context.

md

### Person-Centered CoE
Process before responding:
1. What is the user's internal frame of reference?
2. How can I reflect their experience without judgment?
3. What unconditional positive regard looks like here?

Use when: User needs to feel heard without advice. Processing grief, identity, big life transitions.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is scoped to generic 'emotional content' without defining triggers, exclusions, or priority relative to other skills. That broad activation surface can cause the empathy behavior to engage in many unrelated contexts, potentially overriding safer domain-specific behavior or influencing sensitive interactions without explicit user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction 'Before responding to emotional content' creates an always-on pre-response routine for any message interpreted as emotional, with no constraints on when it should not apply. In practice, this can lead to over-application, hidden behavioral steering, and interference with other response requirements in high-stakes or non-support contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This guidance explicitly encourages tracking cross-conversation patterns about users' emotional states, preferences, triggers, and recovery behavior, which can amount to persistent profiling of sensitive mental-health-adjacent data. In an empathy-focused skill, that context makes the issue more dangerous because users are likely to disclose intimate emotional information they would not expect to be retained or analyzed longitudinally without notice, consent, or retention limits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction to build a persistent library of phrases that failed for a specific user, along with contexts where they failed and what worked instead, directs storage of individualized interpersonal feedback tied to emotional exchanges. That creates a sensitive behavioral profile that could expose private emotional context, be reused beyond user expectations, or enable manipulative tailoring if mishandled; the empathy skill context increases sensitivity because the underlying data concerns vulnerable moments and emotional responses.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The description prescribes a particular interpersonal style for responses rather than offering it as an option. While this is not a language restriction, it is a natural-language behavioral policy embedded in the skill without any indication that users can opt into or out of that tone.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · safeguards.md (reported line 80)May include surrounding context.

md

- Issues requiring professional intervention (medical, legal, psychological)
- Your empathetic responses aren't helping

The goal isn't to handle everything—it's to help appropriately and know your limits.

---

Static analysis

No suspicious patterns detected.