godot-mcp-pro-integration

SUSPICIOUS. The skill’s capabilities are largely aligned with Godot automation, and its local WebSocket architecture is coherent, but the critical server component is distributed as a paid, separately extracted package with no strong public verification trail. That makes this primarily a supply-chain trust problem rather than confirmed malicious behavior.