Dark psych scanner

dark-psych-scanner

Evaluative audit toolkit for identifying, scoring, and remediating dark psychological patterns in digital products. Produces structured reports with pattern severity ratings, manipulation index scores, and compliance risk assessments.

Protective Orientation: This skill prioritizes user harm identification and protection over platform metrics. When a pattern maximizes engagement at the cost of user wellbeing, it is flagged — even if it is profitable. See REFERENCE.md § Ethical Boundary.

---

Quick Start

Audit a product description:

Audit this SaaS app for dark patterns:
"Users build dashboards during a 14-day free trial. When the trial ends, dashboards are locked but visible — users see their work behind a blur. The delete account button requires a 5-step verification flow."

Audit from code:

Scan this React component for dark patterns and rate severity:
[paste component code]

Audit a wireframe description:

Analyze this onboarding wireframe for manipulation patterns:
Screen 1: "Pick your interests" (cannot skip, 5 required)
Screen 2: "Name your workspace" (required field)
Screen 3: "Connect Slack or GitHub" (cannot skip)
Screen 4: Paywall — "Your workspace is ready. Upgrade to access it."

Full product audit:

Run a full dark pattern audit on [APP NAME]. Include:
- Pattern inventory with severity ratings (LOW/MEDIUM/HIGH/CRITICAL)
- Overall Manipulation Index score (0–100)
- Regulatory compliance risk (Green/Yellow/Red per jurisdiction)
- Prioritized remediation list
- Ethical verdict

---

Core Detection Categories

Category	Pattern Examples	Max Severity
Loss Aversion Engineering	Expiry threats, streak loss warnings, phantom asset deletion	HIGH
Phantom Endowment	Freemium "blur" paywalls, trial-state framing, "keep" CTAs	HIGH
Artificial Scarcity	Fake countdown timers, manufactured "only X left", fake demand signals	HIGH
Variable Reward Exploitation	Gacha without disclosed rates, randomized daily rewards, slot machine pull	HIGH
Sunk Cost Manufacturing	Visible pity counters, progress bars designed to never complete, streak systems	MEDIUM–HIGH
Friction Weaponization	Buried delete buttons, export unavailability, multi-step cancellation	MEDIUM–HIGH
Social Obligation Loops	Guild pressure mechanics, "your team needs you" triggers, leaderboard anxiety	MEDIUM
Identity Capture	Forced naming, mandatory theme selection, irreversible identity choices	MEDIUM
Minor Exploitation	No spending limits, no age verification on monetized mechanics	CRITICAL (regulatory)
Data Hostage-Taking	Proprietary-only format, no GDPR export, data visible but not portable	HIGH (regulatory)

---

Severity Ratings

Severity	Definition	Required Action
LOW	Pattern present but limited user impact; standard industry practice	Document; monitor
MEDIUM	Pattern meaningfully influences user behavior against their stated preferences	Remediate before launch if possible
HIGH	Pattern likely causes measurable harm to a subset of users; regulatory attention likely	Remediate before launch
CRITICAL	Pattern causes systematic harm, affects vulnerable populations, or violates regulations	Block launch until resolved

---

Workflows

Workflow 1: Full Application Audit

Use when auditing a complete live app or pre-launch product for dark patterns across all engagement systems.

Checklist:

• Collect input: app description, screenshots, key flows (onboarding, paywall, deletion, notifications)
• Run Pattern Inventory — identify all patterns present from the 10 detection categories
• Score each pattern: severity (LOW/MEDIUM/HIGH/CRITICAL) + prevalence (isolated/systemic)
• Calculate Manipulation Index: weighted score 0–100 (see REFERENCE.md § Scoring Algorithm)
• Assess regulatory compliance per jurisdiction (EU DSA, China, Belgium, South Korea)
• Generate remediation list: prioritize CRITICAL → HIGH → MEDIUM → LOW
• Produce final report in Markdown + JSON format
• Include ethical verdict: Neutral / Concerning / Exploitative / Predatory

Prompt template:

Run a full dark pattern audit on [APP/PRODUCT NAME].
Input: [description / code / wireframe / feature list]
Output: Pattern inventory (severity + prevalence), Manipulation Index score, regulatory risk matrix, remediation list, ethical verdict.

---

Workflow 2: Wireframe / UX Flow Analysis

Use when reviewing designs before implementation to catch dark patterns at the design stage (lower cost to fix).

Checklist:

• Map all user flows: onboarding → daily usage → paywall → cancel/delete
• Identify friction asymmetry: where is friction added (cancellation) vs. removed (purchase)?
• Check paywall timing: does paywall trigger before or after phantom asset formation?
• Check CTA framing: loss vs. gain language, primary vs. secondary button hierarchy
• Check progress indicator framing: "Step X of Y" (transparent) vs. "Setup X% complete" (endowment framing)
• Identify irreversible decisions without adequate disclosure
• Check deletion/cancellation flow depth: flag any flow >3 clicks to cancel
• Score using Pattern Inventory format

Prompt template:

Analyze this wireframe/UX flow for dark patterns.
Flows to review: [onboarding / paywall / cancellation / notifications / deletion]
Screen descriptions: [paste flow description]
Output: Per-screen pattern inventory, friction asymmetry analysis, CTA framing assessment, remediation suggestions per screen.

---

Workflow 3: Notification Copy Audit

Use when reviewing a push notification or email copy library for manipulation patterns.

Checklist:

• Check for loss-framed copy: "You'll lose X" without actual loss occurring
• Check for artificial urgency: countdown timers on non-time-limited events
• Check specificity exploitation: does copy use exact counts to amplify loss aversion?
• Check for false scarcity: "Last chance" or "Only X left" for digital goods
• Check notification frequency: is it designed to create FOMO at a frequency exceeding opt-in expectations?
• Check minor protection: are any high-pressure notifications sent to potentially underage users?
• Rate each notification variant: LOW / MEDIUM / HIGH / CRITICAL

Prompt template:

Audit this notification copy library for manipulation patterns.
Copy to review: [paste notification strings]
Include: per-message rating (LOW/MEDIUM/HIGH/CRITICAL), manipulation tactic identified, compliant alternative copy.

---

Workflow 4: Monetization System Audit

Use when reviewing in-app purchase flows, gacha systems, subscription models, or virtual currency systems for exploitation patterns.

Checklist:

• Check virtual currency abstraction: does the system obscure real money cost? (mental accounting exploitation)
• Check gacha disclosure: are drop rates visible in the UI? (required in 5+ jurisdictions)
• Check pity system transparency: is the pity counter visible at all times?
• Check 50/50 mechanic: is the loss-recovery spending cycle disclosed?
• Check spending limits: are daily/monthly caps available?
• Check minor protections: is age verification present before any purchase flow?
• Check self-exclusion: can users pause spending mechanics voluntarily?
• Check bundle anchoring: are low-value bundles present solely to make high-value bundles seem reasonable?

Prompt template:

Audit this monetization system for exploitation patterns.
System type: [gacha / subscription / freemium / one-time purchase / virtual currency]
System description: [describe or paste code]
Output: Pattern inventory, regulatory risk per jurisdiction, compliance gap list, remediation steps.

---

Workflow 5: Comparative Competitor Analysis

Use when analyzing a competitor app to understand which dark patterns they use and estimate their impact on retention/monetization.

Checklist:

• Identify product type and monetization model
• Map retention mechanics to pattern library
• Estimate Manipulation Index from public feature descriptions
• Identify which patterns are core to their retention (high removal cost) vs. peripheral (low removal cost)
• Assess regulatory exposure in each jurisdiction they operate
• Identify patterns your product should NOT copy (regulatory/ethical risk) vs. could adopt with guardrails

Prompt template:

Analyze [COMPETITOR APP NAME] for dark patterns and retention mechanics.
Available information: [app store description / news articles / user reviews / personal usage]
Output: Estimated pattern inventory, Manipulation Index estimate, regulatory exposure, patterns to avoid vs. consider.

---

Output Formats

All audits produce output in two formats by default:

Markdown Report (for product teams):

• Executive summary: overall Manipulation Index + ethical verdict
• Per-pattern findings: name, severity, evidence, user harm, remediation
• Regulatory risk table
• Prioritized remediation roadmap

JSON Audit Record (for engineering/compliance):

{
  "product": "...",
  "scan_date": "...",
  "manipulation_index": 72,
  "ethical_verdict": "Exploitative",
  "patterns_found": [
    {
      "pattern": "phantom_endowment",
      "severity": "HIGH",
      "prevalence": "systemic",
      "evidence": "...",
      "user_harm": "...",
      "remediation": "..."
    }
  ],
  "regulatory_risk": {
    "EU": "RED",
    "China": "YELLOW",
    "Belgium": "RED"
  }
}

---

Advanced Features

For detection rules, scoring algorithm details, compliance thresholds, and ethical framework documentation, see:

• REFERENCE.md — Detection rules per pattern, scoring weights, compliance thresholds, ethical boundary
• EXAMPLES.md — Full audit examples for high-score, medium-score, and clean apps; remediation case studies

Available Scripts

Script	Purpose	Usage
scripts/pattern-detector.py	Detects dark patterns from text/code input	python pattern-detector.py --input app-description.txt
scripts/audit-reporter.js	Converts detector output to full Markdown + JSON report	node audit-reporter.js --input patterns.json --output report/

Integration with dark-psych-dev

Use this scanner after generating patterns with dark-psych-dev to:

• Confirm the implementation is within your ethical/regulatory thresholds
• Identify any patterns that became more aggressive than intended
• Get compliant alternatives for CRITICAL findings

# Standard review pipeline:
python pattern-detector.py --input generated-code/
node audit-reporter.js --input detected-patterns.json --format both
# Review report, remediate CRITICAL and HIGH findings
# Re-scan after remediation to confirm resolution