godot-mcp-setup

SUSPICIOUS: The stated purpose is coherent with editing Claude Desktop MCP config and using npm/npx, but the key risk is install trust. The skill presents the Godot server as if it were an official modelcontextprotocol package, while the available evidence does not verify that package/org relationship. No credential harvesting or overt exfiltration is shown, but executing an unverified external MCP package through Claude Desktop creates medium-high supply-chain and transitive trust risk.