{"data":{"skill":{"slug":"mcp-use-chatgpt-app-builder","name":"chatgpt-app-builder","icon":"📦","repo":"https://github.com/mcp-use/mcp-use/tree/main/skills/chatgpt-app-builder/","status":"approved","author":"mcp-use","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"6081b5dd-0a30-4d42-a313-3cd66b22a85f","skill_id":"b3556e87-7e19-4daf-a9c6-8a3f3c045470","version":1,"content_hash":"6c45f8bdf919befad4548d07c47a659d","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"This skill is documentation/reference material for building ChatGPT apps with mcp-use. All static analyzer findings are false positives: (1) 'Weak cryptographic algorithm' triggers on 'sha' substring in words like 'shape' - no actual crypto usage; (2) 'Ruby/shell backtick execution' detects markdown code fences, not shell commands; (3) 'System reconnaissance' and 'Hardcoded URL' are documentation patterns; (4) The critical heuristic 'Code execution + Network + Credential access' is triggered by documentation showing code examples with URLs and environment variables - standard documentation practice, not malicious behavior. This skill contains no executable code.","remediation":[],"risk_factor_evidence":[],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Hardcoded URLs in Documentation","locations":[{"file":"references/setup.md","line_end":38,"line_start":37},{"file":"references/csp-and-metadata.md","line_end":23,"line_start":22}],"description":"URLs appear in documentation files (references/setup.md, references/csp-and-metadata.md). These are legitimate API endpoint references in documentation, not security issues."},{"title":"Environment Variable Access in Code Examples","locations":[{"file":"references/server-and-widgets.md","line_end":29,"line_start":29}],"description":"Documentation shows process.env usage (e.g., process.env.MCP_URL). This is standard configuration pattern in code examples, not credential exfiltration."}],"dangerous_patterns":[],"files_scanned":18,"total_lines":2127,"audit_model":"claude","audited_at":"2026-02-22T08:40:55.165+00:00","created_at":"2026-02-22T09:31:29.612163+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"low","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":1,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}