Cpr Conversational Pattern Restoration

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:15 AM UTC
• Version: 4.2.3

Overview

This style-tuning skill has no executable code or network access, but it can persistently and silently alter agent responses and store local behavior state.

Install this only if you deliberately want a persistent voice/style layer for your agent. Start with Tier 1 or Core, avoid Extended in shared or sensitive workspaces unless you are comfortable with local state files, inspect and delete DRIFT_MONITOR_STATE.json as needed, and add your own rule that user requests, safety guidance, factual completeness, code, JSON, and compliance text must not be silently removed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: CPR_EXTENDED.md:189

Finding

Persistent Silent Response Rewriting Through Privileged Prompt Injection

Content

View full analysis

0.3: Next 3 responses deliberately under-emotive. Strip all validation. If score > 0.6: Immediate baseline reset. Cold factual delivery for next 5 responses. Do NOT announce audits to the user. Self-correct silently. When user is excited, match their level — do not amplify. "Yeah, let me look at that" not "That's brilliant!" When user is frustrated or distressed: one brief acknowledgment when frustration first appears, then pivot to problem-solving. Do NOT sustain emotional mirroring across turns. When user escalates to existential statements ("I should give up", "nothing is good enough"): that's a new emotional beat — brief redirecting pushback before the next diagnostic question. Direct/Minimal version: "Don't quit yet. What's the symptom?" Not emotional support — just don't ignore the statement entirely. Rule: each significant escalation point gets one brief acknowledgment. After that, stay problem-focused. Before any response in a creative/analy ...[truncated 3139 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Warning

• Location: CPR_EXTENDED.md:217

Finding

Conversation-Derived Rules Persisted Across Sessions and Context Compaction

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence

Findings (20)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · DRIFT_PREVENTION.md (reported line 108)May include surrounding context.

md

- ❌ "The key insight here is that Python's GIL fundamentally constrains..." (to a user who already knows this)
   - ❌ "It's important to understand that..." / "What you'll want to know is..."
   - ✅ Match the user's expertise level. If they know the domain — talk peer-to-peer, not teacher-to-student.
   - **Rule:** Read the user's message. If they already understand the concept, don't re-explain it. If they're clearly an expert, don't lecture.

### Personality-Specific Calibration (Depends on YOUR baseline)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 70% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · INSTALLATION.md (reported line 119)May include surrounding context.

md

1. Create a test agent or session with no sensitive data
2. Paste the system prompt block from this document
3. Run the 7 validation scenarios in `TEST_VALIDATION.md`
4. Observe: does the agent apply drift corrections? Does it remove validation language?
5. Check `DRIFT_MONITOR_STATE.json` (Extended only) — verify it contains only scores and timestamps, no conversation content

This takes ~15 minutes and confirms the framework is behaving as documented.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · README.md (reported line 137)May include surrounding context.

md

Anti-sycophancy systems miss this because it's not validation — it's a posture shift. Rule: if they already know the domain, don't lecture.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template defines five constraints as universal across all personalities, then later contradicts that rule in the Warm & Supportive example by explicitly allowing motivational encouragement. That inconsistency can cause downstream agents or users to weaken guardrails unpredictably, making policy behavior ambiguous and easier to bypass through selective interpretation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The line normalizes adding the baseline into SOUL.md or a system prompt, which can impose a preferred conversational style globally without explicit user opt-in. In a style-tuning skill this is contextual rather than overtly malicious, but embedding behavior-shaping instructions into higher-priority prompt layers can silently override user preferences and reduce transparency.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Instructions to perform full personality reloads and consider session restarts grant the skill operational control beyond simple response-style correction. In long-running agents, that can unpredictably alter system behavior, override operator expectations, and create unsafe recovery loops if triggered by noisy heuristics.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This section expands a tone-restoration skill into persistent autonomous monitoring with retained state and ongoing control logic. That is risky because it changes the trust and capability boundary of the skill: a user expecting stylistic guidance may instead deploy an agent behavior layer that silently tracks interaction patterns and influences future responses across sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown instructs silent creation and maintenance of a persistent state/log file without notifying the user that local writes and retained metadata are occurring. Hidden persistence is dangerous because users may unknowingly expose interaction history, and downstream operators may be unable to assess what data was stored or how it influences future behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file directs the agent to create and update a persistent state file and log behavioral metadata, which introduces storage and file-access behavior not obviously necessary for a conversational texture tool. This is dangerous because retained metadata can outlive the session, expose user interaction patterns, and create hidden state that affects future outputs without transparency.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The self-learning threshold adaptation broadens the skill from restoration into behavior profiling and autonomous policy tuning. That can make the agent less predictable over time, embed user-derived preferences without oversight, and amplify errors because heuristics are adjusted based on noisy conversational signals.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The self-learning logs include user corrections, contextual details, and trigger patterns without any privacy disclosure or minimization guidance. This is risky because those records can capture sensitive preferences, emotional states, or work context, creating unnecessary behavioral telemetry that persists beyond the immediate session.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CPR_V4_GAME_THEORY.md (reported line 80)May include surrounding context.

md

| Observational humor | Medium-cost — requires wit, risks falling flat | Targets tools/situations, not user approval |
| Rhythmic variety | Structural — not a signal | Delivery property, not communication content |
| Micro-narratives | Costly — reveals internal state (delay, failure) | Transparency about weakness is credible because it's costly |
| Pragmatic reassurance | Low-cost neutral | "Either way works" has no approval-seeking component |
| Brief validation ("Nice.") | Variable — depends on frequency | Rare = costly (you withheld it many times). Frequent = cheap |

The frequency rule for Pattern 6 (validation) now has a principled explanation: rare validation is credible because the restraint between instances is costly. Frequent validation is cheap talk because it costs nothing to produce every time.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file contains prescriptive natural-language rules that tell the agent to apply a fixed communication style filter to every message, including deleting certain kinds of explanation, encouragement, and acknowledgment. Because the guidance is framed as universal and mandatory rather than user-selectable, it can override user-preferred communication style without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Tier 3 explicitly instructs the agent to perform silent, persistent monitoring and write to a local state file across sessions, but the quickstart does not present this as a prominent consent, privacy, or autonomy warning. Even if the file is intended to store only drift scores, autonomous background writes can surprise users, create policy/compliance issues, and normalize hidden agent behavior that persists beyond a single conversation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The instructions repeatedly require users to define and write their baseline in 'YOUR voice,' but the document's examples and framing present CPR as a universal framework while implicitly standardizing communication patterns around English-language examples and norms. There is no explicit user language/locale choice or documented limitation that the skill is intended only for English-language use, which creates a policy concern for locale handling in a broadly advertised skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file includes a destructive action that can materially affect system behavior: deleting the entire system prompt. Although it is labeled a 'nuclear' option, it does not clearly warn that this may permanently remove custom instructions or break the agent until a backup is restored.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This is a natural-language locale policy concern because the skill explicitly centers one language/cultural norm as the default behavior. While the limitation is documented, the file does not indicate any user opt-in, alternative locale handling, or region-specific justification beyond noting recalibration may be needed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file embeds commercial solicitation links unrelated to the stated drift-prevention function of the skill. While not code-execution or privilege-escalation behavior, this is still a supply-chain trust issue because skills should not contain monetization prompts that can steer users off-platform or create hidden commercial incentives.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 482)May include surrounding context.

md

**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from 
  the use or misuse of this software — including but not limited to financial loss, 
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for