Here are the checksums for my copy, also downloaded from github:
$ md5sum esptool.exe
dc22f4eba1c32676a1d2b16132d0552c *esptool.exe
$ sha1sum esptool.exe
957aa8fa64f99be977eedf1b75f4bcab67392872 *esptool.exe
Without analyzing the code and compiling it yourself, it's impossible to be certain it's clean, but I haven't had a problem, and Windows Defender has not flagged it.