cli-continues-session-transfer
Warn
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill reads from numerous sensitive local application directories to extract session state and history. These include path patterns like
~/.claude/projects/,~/.cursor/projects/,~/.copilot/session-state/, and VS Code's global storage for extensions like Cline and Roo Code. - [DATA_EXFILTRATION]: It extracts terminal shell commands and conversation messages which frequently contain sensitive information. The documentation explicitly states that 'API keys in session history are preserved as-is', creating a risk of credential exposure during session transfers.
- [COMMAND_EXECUTION]: The tool automates the invocation of external CLI applications (e.g.,
gemini,cursor,codex) and implements a mechanism to pass arbitrary flags and arguments directly to these sub-processes, which can lead to unintended command execution if input is maliciously crafted. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection risk. It ingests untrusted data from session storage paths (e.g.,
~/.claude/projects/,~/.cursor/projects/). Handoff documents lack explicit boundary markers or 'ignore' instructions. The skill has the capability to execute sub-processes for target AI tools with passed flags. It explicitly avoids sanitizing credentials found in messages. - [EXTERNAL_DOWNLOADS]: The installation instructions recommend running the tool via
npx continuesor installing thecontinuespackage from the npm registry.
Audit Metadata