ClawHub
Back to skill

Security audit

PromptVault Team Prompt Library

Security checks across malware telemetry and agentic risk

Overview

PromptVault is a local prompt library tool; its main risk is accidental sharing of sensitive prompt contents, not hidden or malicious behavior.

Install only if you are comfortable storing prompts in plaintext local files. Do not store API keys, credentials, regulated personal data, or confidential workflows unless the vault location is protected with appropriate filesystem permissions or encryption. Review JSON exports and generated HTML before sharing, and import vault files only from trusted sources because replace or merge can change local prompt content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README encourages exporting prompts, notes, and changelog data for sharing, including an option to include private metadata, but does not prominently warn that prompts and notes may contain secrets, internal instructions, credentials, customer data, or other sensitive information. In a prompt-management tool, this omission can directly lead to accidental data disclosure when users share export files with teammates or third parties.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The HTML browse workflow is presented as easy to share, but the generated file appears to contain prompt contents and supports copying them to the clipboard. Without a clear warning, users may treat the HTML as harmless UI output rather than a portable bundle of all stored prompt data, increasing the chance of broad unintended disclosure.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill encourages exporting, importing, and sharing vault data but does not clearly warn that prompt text, notes, author names, ratings, and changelog entries may contain sensitive internal instructions, proprietary workflows, or confidential project context. In a team setting, users may reasonably assume these artifacts are safe to circulate, leading to unintended disclosure when files are shared broadly.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The generated HTML browse file is described as easy to share and usable offline, but the documentation does not clearly state that the HTML may embed the full prompt corpus and related metadata in a portable file. Anyone receiving that file can inspect, copy, or redistribute all included prompt content, making accidental oversharing likely.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.