apicurio-registry

SUSPICIOUS. The skill is internally coherent as a Membrane-based Apicurio integration, and its installer appears official, so this is not confirmed malware. However, it routes authentication, API actions, and proxy traffic through Membrane rather than directly to Apicurio, creating meaningful intermediary trust and credential-handling risk; combined with unpinned CLI installation, this makes the skill medium risk.