registry-default-mirror

SUSPICIOUS: the core npm-default purpose partly aligns with the commands, but the skill is internally inconsistent because it requires an operator-supplied REGISTRY_URL and writes it to ~/.npmrc before resetting npm, while also fetching release notes from an unverified unrelated domain. No direct credential exfiltration or payload execution is shown, but registry redirection and third-party download trust make the skill medium risk.