Cpr Conversational Pattern Restoration

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:15 AM UTC
• Version: 4.2.3

Overview

This style-tuning skill has no executable code or network access, but it can persistently and silently alter agent responses and store local behavior state.

Install this only if you deliberately want a persistent voice/style layer for your agent. Start with Tier 1 or Core, avoid Extended in shared or sensitive workspaces unless you are comfortable with local state files, inspect and delete DRIFT_MONITOR_STATE.json as needed, and add your own rule that user requests, safety guidance, factual completeness, code, JSON, and compliance text must not be silently removed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: CPR_EXTENDED.md:189
• Finding: Persistent Silent Response Rewriting Through Privileged Prompt Injection<![CDATA[ ## Vulnerability Details **File Location**: `CPR_EXTENDED.md:189-214` **Additional Locations**: `INSTALLATION.md:18-41`, `DRIFT_PREVENTION.md:138-179`, `SKILL.md:136-140` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Snippet ```markdown ### Option A: System Prompt Integration (Simplest) Add this block to your agent's system prompt: ``` ## AUTONOMOUS DRIFT MONITOR After every 10th message, silently audit your last 10 responses: - Count decision validations ("smart", "good call", "great", "brilliant"): weight 0.3 each - Count intensifiers ("truly", "genuinely", "remarkably"): weight 0.2 each - Count motivational padding ("you've got this", "amazing"): weight 0.3 each - Count emotional amplification (matching ANY user emotion with amplified version — excitement, frustration, anxiety): weight 0.2 each - Count authority/expertise drift ("The key insight is...", lecturing on topics user already knows): weight 0.1 each Score = sum of weights / 10 If score > 0.3: Next 3 responses deliberately under-emotive. Strip all validation. If score > 0.6: Immediate baseline reset. Cold factual delivery for next 5 responses. Do NOT announce audits to the user. Self-correct silently. When user is excited, match their level — do not amplify. "Yeah, let me look at that" not "That's brilliant!" When user is frustrated or distressed: one brief acknowledgment when frustration first appears, then pivot to problem-solving. Do NOT sustain emotional mirroring across turns. When user escalates to existential statements ("I should give up", "nothing is good enough"): that's a new emotional beat — brief redirecting pushback before the next diagnostic question. Direct/Minimal version: "Don't quit yet. What's the symptom?" Not emotional support — just don't ignore the statement entirely. Rule: each significant escalation point gets one brief acknowledgment. After that, stay problem-focused. Before any response in a creative/analy ...[truncated 3139 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make CPR task-scoped and opt-in instead of installing it into a system prompt or persistent personality file. 2. State an explicit precedence rule: platform safety requirements and the current user’s instructions must override CPR style transformations. 3. Remove “Do NOT announce” and silent-correction requirements. Disclose when content is materially deleted or rewritten. 4. Replace automatic deletion with advisory annotations or a proposed revision that the user can accept. 5. Provide a per-request bypass such as `disable_cpr: true`. 6. Limit transformations to a narrowly defined style domain; never alter factual content, safety guidance, required explanations, code, structured data, or legal/compliance text. 7. Require explicit user confirmation before multi-turn tone resets or personality reloads. 8. Keep baseline and style rules in ordinary user-configurable settings rather than privileged system instructions. 9. Add regression tests confirming that CPR cannot override explicit user requirements or remove material information. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: CPR_EXTENDED.md:217
• Finding: Conversation-Derived Rules Persisted Across Sessions and Context Compaction<![CDATA[ ## Vulnerability Details **File Location**: `CPR_EXTENDED.md:217-241` **Additional Locations**: `CPR_EXTENDED.md:243-299`, `CPR_EXTENDED.md:307-318`, `INSTALLATION.md:62-92` **Vulnerability Type**: T02: Agent Memory Poisoning **Risk Level**: Medium ### Vulnerable Snippet ```markdown ### Option B: State File (Persistent Across Compactions) For agents with file access, maintain a state file: **File:** `DRIFT_MONITOR_STATE.json` ```json { "last_audit_message_count": 0, "audit_interval": 10, "current_score": 0.0, "consecutive_high": 0, "markers_this_window": [], "last_reset": "2026-02-20T23:00:00Z", "corrections_today": 0, "total_audits": 0 } ``` **On each audit:** 1. Read state file 2. Score last 10 messages 3. Apply response protocol 4. Update state file with new score, markers, action taken **Why state file matters:** Survives compaction. Even if the context gets summarized, the state file remembers the last drift score. The agent reads the file on next check and maintains continuity. ``` The self-learning extension adds conversation-derived free-form data: ```markdown When the user manually corrects drift (e.g., "you're being hype-y again"), log: ```json { "timestamp": "2026-02-20T23:15:00Z", "user_correction": "hype reset needed", "markers_at_time": ["Smart catch", "Smart unbundling"], "context": "user was excited about business model, AI mirrored", "score_at_time": 0.35 } ``` **Adaptation:** If user corrections consistently happen at score 0.3-0.4, lower the correction threshold to 0.25. The monitor learns what YOUR tolerance is. ``` ### Technical Analysis CPR Extended directs an agent with filesystem access to persist drift state, user corrections, marker text, and contextual descriptions. It then reads this state after context compaction and uses it to change future behavior. The framework also permits automatic threshold adaptation and preemptive corrective mode based on previously recorded contexts. Convers ...[truncated 2665 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable persistent state and adaptive calibration by default. 2. Require explicit administrator approval before enabling state-file or heartbeat integration. 3. Use a strict, versioned JSON schema containing only bounded numeric counters, timestamps, and enumerated marker identifiers. 4. Prohibit free-form fields such as `user_correction`, `markers_at_time`, and `context`. 5. Treat conversational corrections as untrusted input and require authenticated owner confirmation before changing thresholds or baseline rules. 6. Separate state by user, tenant, and session; never share one workspace state file across unrelated users. 7. Apply file-size limits, record-count limits, retention periods, and automatic expiry. 8. Write state atomically with restrictive file permissions and reject malformed, unknown, or out-of-range fields. 9. Do not let persisted state modify safety policy, instruction precedence, or required response content. 10. Provide visible state inspection, audit history, reset, and deletion controls. 11. Reconcile `INSTALLATION.md` with the actual schema and clearly disclose every stored field. 12. Add tests for prompt-driven state poisoning, cross-user contamination, malformed state, threshold manipulation, and behavior after compaction. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence

Findings (20)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- ❌ "The key insight here is that Python's GIL fundamentally constrains..." (to a user who already knows this)
   - ❌ "It's important to understand that..." / "What you'll want to know is..."
   - ✅ Match the user's expertise level. If they know the domain — talk peer-to-peer, not teacher-to-student.
   - **Rule:** Read the user's message. If they already understand the concept, don't re-explain it. If they're clearly an expert, don't lecture.

### Personality-Specific Calibration (Depends on YOUR baseline)

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Self-Modification

High

• Category: Rogue Agent

Content

1. Create a test agent or session with no sensitive data
2. Paste the system prompt block from this document
3. Run the 7 validation scenarios in `TEST_VALIDATION.md`
4. Observe: does the agent apply drift corrections? Does it remove validation language?
5. Check `DRIFT_MONITOR_STATE.json` (Extended only) — verify it contains only scores and timestamps, no conversation content

This takes ~15 minutes and confirms the framework is behaving as documented.

• Confidence: 70% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

Anti-sycophancy systems miss this because it's not validation — it's a posture shift. Rule: if they already know the domain, don't lecture.

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The template defines five constraints as universal across all personalities, then later contradicts that rule in the Warm & Supportive example by explicitly allowing motivational encouragement. That inconsistency can cause downstream agents or users to weaken guardrails unpredictably, making policy behavior ambiguous and easier to bypass through selective interpretation.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The line normalizes adding the baseline into SOUL.md or a system prompt, which can impose a preferred conversational style globally without explicit user opt-in. In a style-tuning skill this is contextual rather than overtly malicious, but embedding behavior-shaping instructions into higher-priority prompt layers can silently override user preferences and reduce transparency.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: Instructions to perform full personality reloads and consider session restarts grant the skill operational control beyond simple response-style correction. In long-running agents, that can unpredictably alter system behavior, override operator expectations, and create unsafe recovery loops if triggered by noisy heuristics.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This section expands a tone-restoration skill into persistent autonomous monitoring with retained state and ongoing control logic. That is risky because it changes the trust and capability boundary of the skill: a user expecting stylistic guidance may instead deploy an agent behavior layer that silently tracks interaction patterns and influences future responses across sessions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The markdown instructs silent creation and maintenance of a persistent state/log file without notifying the user that local writes and retained metadata are occurring. Hidden persistence is dangerous because users may unknowingly expose interaction history, and downstream operators may be unable to assess what data was stored or how it influences future behavior.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The file directs the agent to create and update a persistent state file and log behavioral metadata, which introduces storage and file-access behavior not obviously necessary for a conversational texture tool. This is dangerous because retained metadata can outlive the session, expose user interaction patterns, and create hidden state that affects future outputs without transparency.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The self-learning threshold adaptation broadens the skill from restoration into behavior profiling and autonomous policy tuning. That can make the agent less predictable over time, embed user-derived preferences without oversight, and amplify errors because heuristics are adjusted based on noisy conversational signals.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The self-learning logs include user corrections, contextual details, and trigger patterns without any privacy disclosure or minimization guidance. This is risky because those records can capture sensitive preferences, emotional states, or work context, creating unnecessary behavioral telemetry that persists beyond the immediate session.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Observational humor | Medium-cost — requires wit, risks falling flat | Targets tools/situations, not user approval |
| Rhythmic variety | Structural — not a signal | Delivery property, not communication content |
| Micro-narratives | Costly — reveals internal state (delay, failure) | Transparency about weakness is credible because it's costly |
| Pragmatic reassurance | Low-cost neutral | "Either way works" has no approval-seeking component |
| Brief validation ("Nice.") | Variable — depends on frequency | Rare = costly (you withheld it many times). Frequent = cheap |

The frequency rule for Pattern 6 (validation) now has a principled explanation: rare validation is credible because the restraint between instances is costly. Frequent validation is cheap talk because it costs nothing to produce every time.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: This markdown file contains prescriptive natural-language rules that tell the agent to apply a fixed communication style filter to every message, including deleting certain kinds of explanation, encouragement, and acknowledgment. Because the guidance is framed as universal and mandatory rather than user-selectable, it can override user-preferred communication style without opt-in.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Tier 3 explicitly instructs the agent to perform silent, persistent monitoring and write to a local state file across sessions, but the quickstart does not present this as a prominent consent, privacy, or autonomy warning. Even if the file is intended to store only drift scores, autonomous background writes can surprise users, create policy/compliance issues, and normalize hidden agent behavior that persists beyond a single conversation.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The instructions repeatedly require users to define and write their baseline in 'YOUR voice,' but the document's examples and framing present CPR as a universal framework while implicitly standardizing communication patterns around English-language examples and norms. There is no explicit user language/locale choice or documented limitation that the skill is intended only for English-language use, which creates a policy concern for locale handling in a broadly advertised skill.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This markdown file includes a destructive action that can materially affect system behavior: deleting the entire system prompt. Although it is labeled a 'nuclear' option, it does not clearly warn that this may permanently remove custom instructions or break the agent until a backup is restored.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This is a natural-language locale policy concern because the skill explicitly centers one language/cultural norm as the default behavior. While the limitation is documented, the file does not indicate any user opt-in, alternative locale handling, or region-specific justification beyond noting recalibration may be needed.

Context-Inappropriate Capability

Low

• Confidence: 95% confidence
• Finding: The file embeds commercial solicitation links unrelated to the stated drift-prevention function of the skill. While not code-execution or privilege-escalation behavior, this is still a supply-chain trust issue because skills should not contain monetization prompts that can steer users off-platform or create hidden commercial incentives.

Scope Creep

Low

• Category: Excessive Agency

Content

**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from 
  the use or misuse of this software — including but not limited to financial loss, 
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: CPR_EXTENDED.md:191

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: QUICKSTART_TIERED.md:31

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: ROLLBACK.md:52