A path traversal vulnerability exists in the `evolver fetch` subcommand of @evomap/evolver before version 1.70.0-beta.5. The sanitization of the Hub-supplied `skill_id` allows `..` to bypass checks and cause files to be written outside the intended directory, specifically into the user's current working directory. This enables an attacker controlling the Hub or a malicious participant to overwrite critical files such as `index.js` or `package.json`, leading to remote code execution on subsequent runs of evolver.