continues-ai-session-transfer
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill encourages the installation and execution of the continues package from the npm registry using npx or npm install.
- [COMMAND_EXECUTION]: The skill relies on shell commands to interact with the file system, query local session databases (SQLite), and launch AI tools for session resumption.
- [DATA_EXFILTRATION]: The skill aggregates and exposes sensitive session data from numerous application-specific paths including ~/.claude, ~/.cursor, ~/.gemini, and VS Code global storage. These files contain chat logs, file modifications, and command outputs that may include proprietary information or secrets.
- [PROMPT_INJECTION]: The skill facilitates the transfer of unvalidated session history between different AI agents, creating a surface for indirect prompt injection. Ingestion points: Session logs in local paths such as ~/.claude/projects/*/session.jsonl. Boundary markers: None identified in the transfer process. Capability inventory: Broad read access to assistant histories and shell resumption capabilities. Sanitization: No validation or sanitization of source session data is documented.
Audit Metadata