The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install and run the continues package from the NPM registry using npx continues or npm install -g continues. This package is an external dependency from a source not recognized as a trusted vendor.
[COMMAND_EXECUTION]: The skill relies on executing the continues CLI tool to perform session discovery, indexing, and handoff operations, which involves running shell commands on the host system.
[DATA_EXFILTRATION]: The skill accesses highly sensitive local directories to extract session history, including conversation logs and shell command outputs. Impacted paths include ~/.claude, ~/.cursor, ~/.gemini, ~/.copilot, and VS Code global storage paths. While this is the core function of the skill, it exposes private development history and terminal data.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from session files across 16+ tools and interpolates the content into "handoff documents" used as prompts for other AI agents.
Ingestion points: Local session storage files such as session.jsonl, sessions.db, and chat history JSON files from various coding assistants.
Boundary markers: None mentioned; the generated handoff markdown is intended to be parsed and followed by the target AI agent without explicit isolation.
Capability inventory: File system read access across user home directories and potential execution of target tools via shell command wrappers.
Sanitization: There is no evidence of sanitization or filtering of the content extracted from source sessions before it is passed to the next agent.

continues-ai-session-transfer