friction-detector

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:13 AM UTC
• Version: 1.9.19

Overview

This skill is purpose-aligned as a session-retrospective logger, but it needs review because it persists transcript-derived signals and learning entries without clear consent, redaction, or enforced deletion controls.

Install only if you are comfortable with local cross-session logging of workflow friction. Before using it, review what will be written under ~/.claude/friction and ~/.claude/skills/LEARNINGS.md, avoid running it on sensitive sessions unless redaction is added, and periodically inspect or delete retained logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:96

Finding

Persistent Storage of Unredacted Session-Derived Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 96-108, 137-145, and 196-198
Vulnerability Type: Persistent plaintext storage of potentially sensitive session data
Risk Level: Medium

Vulnerable Code

markdown

```json
{
  "schema_version": "session-capture/1",
  "session_id": "2026-04-14-abc12345",
  "timestamp": "2026-04-14T10:23:00Z",
  "source": "friction-detector",
  "payload": {
    "signal_type": "retry_loop",
    "description": "rg command failed 3x, fell back to grep",
    "context": "searching for pattern in node_modules",
    "weight": "medium"
  }
}

text

```markdown
### Step 4: Propose Graduations

Tier 2 crossing: append to LEARNINGS.md friction section.
Tier 3 crossing: present proposal with evidence to user,
wait for explicit approval before any modification.

### Step 5: Store Results

Write session log to
`~/.claude/friction/sessions/{date}-{session_id}.json`
and update `~/.claude/friction/index.json`.

markdown

**Consumes from**: session transcripts,
`aggregate_learnings_daily` hook data, and the
performance tracker for trend correlation.

Technical Analysis

The skill directs the agent to consume session transcripts and preserve signal descriptions and contextual text in JSON files under the user's home directory. Recurring transcript-derived patterns may also be appended automatically to the persistent ~/.claude/skills/LEARNINGS.md file.

Session transcripts can contain credentials, private filesystem paths, proprietary source fragments, personal information, or other confidential user content. The instructions do not require secret detection, contextual redaction, data minimization, owner-only file permissions, or user consent before transcript-derived content is written. Although the document states elsewhere that session files have a 30-day retention period, the reviewed artifact contains no implementation that enfor ...[truncated 2064 chars]

Remediation

View remediation

Remediation Suggestions

1. Store only structured signal identifiers, timestamps, numeric counts, and sanitized command categories. Do not retain raw transcript excerpts, tool output, prompts, secrets, or arbitrary contextual text.
2. Apply secret and personal-data detection before persistence. Redact tokens, passwords, authorization headers, private keys, environment values, private paths, email addresses, and source fragments.
3. Require explicit user consent before processing transcripts or writing transcript-derived material to persistent storage.
4. Require review and approval for Tier 2 LEARNINGS.md updates, not only Tier 3 changes to CLAUDE.md.
5. Create directories with mode 0700 and files with mode 0600, and reject symlinks or unexpected file types before writing.
6. Write files atomically using securely created temporary files in the destination directory, then rename them into place.
7. Implement and test the documented 30-day deletion policy rather than relying on a declarative retention statement.
8. Validate proposed learning entries against trusted evidence and prevent arbitrary transcript content from becoming agent instructions.
9. Provide controls that let users inspect, delete, disable, or shorten retention of captured data.
10. Document exactly which transcript fields are processed, how similarity is calculated, and which components subsequently consume the stored information.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This skill directs the agent to write per-session logs and maintain an index in ~/.claude/friction/, creating cross-session persistence of user interaction data. Even though the feature is framed as retrospective learning and not overt exfiltration, persistent recording of session signals can capture sensitive workflow details and increase exposure if local files are later accessed by other tools, users, or processes.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md

### Step 5: Store Results

Write session log to
`~/.claude/friction/sessions/{date}-{session_id}.json`
and update `~/.claude/friction/index.json`.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs persistent storage of session-derived friction logs and an index under the user's home directory, but it does not pair that behavior with a clear user-facing disclosure or consent step. Because the stored data may include session context, user corrections, and behavioral signals across sessions, this creates a privacy and data-retention risk if sensitive content is captured or if the user is unaware that long-lived local telemetry is being accumulated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.