cli-continues-session-transfer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly reads and assembles full session histories (including "API keys in session history are preserved as‑is") into handoff documents and debug prompts, which requires including any secret values verbatim in generated outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider-authored free text can be ingested because the skill reads and parses other tools’ stored session transcripts/messages from local session directories (e.g., ~/.claude/projects/, ~/.cursor/.../agent-transcripts/, ~/.gemini/tmp/*/chats/, SQLite/JSONL/YAML under ~/.local/share/...) and then injects the extracted “Recent Conversation”/messages into the target handoff prompt at runtime; those transcripts may include messages authored by third parties (e.g., other users in shared chats, tool outputs containing scraped/public content, or any non-operating-user text present in the session history).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). Yes — the skill instructs running "npx continues" / "npm install -g continues", which at runtime fetches and executes the package from the npm registry (e.g. https://registry.npmjs.org/continues), meaning remote code is executed that generates and injects handoff prompts into other tools.