opentargets-skill

No clear evidence of intentional malware (no obfuscation, exec/eval, subprocesses, persistence, or suspicious domain generation). The module is best characterized as a legitimate GraphQL client/CLI with meaningful security risks when driven by untrusted input: it can read local files via query_path and write raw response data to arbitrary filesystem locations via raw_output_path, and it will transmit caller-supplied query/variables to an external service. In a supply-chain context, the security posture depends heavily on how this tool is invoked and whether stdin/path inputs can be attacker-controlled.