GraphQL Schema Registry Client

SUSPICIOUS: the stated GraphQL schema-management purpose is plausible, but the actual footprint shown here is mainly a transitive skill installer from an unverifiable publisher, with inconsistent provenance metadata (`graphql-js` vs Apollo/rover functionality). No direct exfiltration or malware is visible in the provided text, but the install trust chain is not proportionate enough to classify as benign.