ghost-exo

No clear evidence of intentional malware or supply-chain sabotage is present. The code is a conventional authenticated skill upload/download client. It has a notable arbitrary file write/path traversal weakness during download because API-provided paths are not normalized and constrained to the output directory. Risk is primarily dependent on the trustworthiness of EXO_API_URL and its responses.