blender-mcp

SUSPICIOUS. The core capabilities fit a Blender-control skill, but the install path is weaker than necessary: it fetches a mutable raw GitHub addon from a different personal account than the listed author instead of using a pinned or registry-backed release. Data flow stays local and purpose-aligned, so this is not confirmed malware, but the supply-chain trust is high risk.