continues-cli-session-transfer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs the agent to read and inject full session messages, file contents and tool activity into generated handoff documents (and can dump/export full sessions), so any API keys, tokens, passwords or secrets present in those sessions would be included verbatim in the LLM output — enabling secret exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required cross-tool handoff workflow reads outsider-authored session content from other tools’ stored transcripts (e.g., JSONL/JSON/SQLite under ~/.claude/..., ~/.cursor/..., ~/.gemini/...) and injects it into the destination tool’s LLM context as the first message in the generated handoff markdown document.