godot-mcp-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a runtime install/execute command (npx @modelcontextprotocol/server-godot) that fetches and runs remote package code, and the referenced repository https://github.com/modelcontextprotocol/servers/tree/main/src/godot points to that external code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill includes and demonstrates a global npm install command and explicitly suggests "Run PowerShell as Administrator," which encourages performing system-wide package installation and elevating privileges that modify the host machine's state.