friction-detector
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests session transcripts and user feedback to identify recurring patterns. This presents a potential attack surface where malicious input in a previous session could influence the agent's learning logic in subsequent sessions.
- Ingestion points: Processes session logs and historical transcripts stored in
~/.claude/friction/sessions/. - Boundary markers: The skill employs a structured JSON envelope (
session-capture/1) to delimit data, which provides a layer of data/instruction separation. - Capability inventory: File system read/write access to project and configuration directories; execution of search utilities (
grep,rg). - Sanitization: No specific content sanitization is described, although the graduation logic relies on frequency and weighting rather than direct execution of logged content.
- [COMMAND_EXECUTION]: The skill uses shell commands (
mkdir,rg,grep) to organize and search session data. These commands are restricted to the local file system and are standard for this type of log analysis functionality.
Audit Metadata