blender-mcp

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This is a personal GitHub repository (unknown/unverified user) that the skill explicitly tells you to download and execute addon code (install/enable addon.py and run via Blender), which is a common vector for malware distribution from untrusted sources.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly requires using and installing the "ahujasid/blender-mcp" project (https://github.com/ahujasid/blender-mcp) and instructs installing/enabling its addon in Blender, which means code from that external repository would be fetched and executed at runtime inside Blender.