Arbitrary file write via unchecked output path

Path traversal in EvoMap Evolver before 1.69.3 allows remote authenticated users to write files through a crafted fetch --out path. The fetch handler in index.js strips the --out= prefix and passes the remaining user-controlled path directly to recursive directory creation and skill-file writes without restricting resolution to the intended skills directory. Exploitation requires access to invoke the fetch command and write permission under the Evolver process account; resulting writes can overwrite application, configuration, or system files within that account's permissions.