kairos-bundle

SUSPICIOUS. The functional scope matches the stated backup/import purpose, and there is no downloader or obvious malicious behavior. However, trust is weakened by the unverified `kairos` CLI, unclear publisher relationship for the local API service, and default token-bearing HTTP traffic to `localhost:3000` without documented provenance or security guarantees.