The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple coding tool session histories and injects them into a new AI assistant context.
Ingestion points: Reads data from numerous local directories including ~/.claude/, ~/.cursor/, and VS Code globalStorage paths.
Boundary markers: The handoff document structure lacks explicit boundary markers or instructions to the target agent to treat the imported history as untrusted content.
Capability inventory: The target tools (Claude Code, Cursor, etc.) have broad system access, including shell execution and file system writes.
Sanitization: Documentation notes that API keys in session history are preserved as-is, requiring manual user sanitization.
[DATA_EXFILTRATION]: The skill reads from directories that contain sensitive project history and potentially private information.
Sensitive paths: Specifically targets ~/.claude/, ~/.cursor/, ~/.codex/, ~/.gemini/, ~/.copilot/, and others.
Exposure risk: These logs typically contain full source code, command execution output, and reasoning steps that may include sensitive project details or hardcoded secrets found during the development process.
[EXTERNAL_DOWNLOADS]: The skill is distributed as a Node.js package, with instructions to fetch and execute it via npx continues or npm install -g continues from the public npm registry.
[COMMAND_EXECUTION]: Operation of the skill relies on executing the continues CLI tool to perform scanning, listing, and session extraction tasks.

cli-continues-session-transfer