prompt-governance

No clear evidence of malware or unauthorized data exfiltration. The utility has a path traversal risk: crafted prompt names can direct writes outside the versions directory, and malicious catalog metadata can direct diff operations to read files outside it. Validate names and enforce resolved-path containment before file access.