Skills chatgpt-app-builder
📦
chatgpt-app-builder
v1.0.0 Content revision r2 High Risk 🌐 Network access⚙️ External commands📁 Filesystem access🔑 Env variables⚡ Contains scripts
Build Production-Ready ChatGPT Apps
Building a ChatGPT App requires coordinated server, widget, security, testing, and submission work. This skill provides a phased workflow and reusable TypeScript templates.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "chatgpt-app-builder" from https://skillstore.io/skills/bayramannakov-chatgpt-app-builder.md and its manifest at https://skillstore.io/api/skills/bayramannakov-chatgpt-app-builder/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "chatgpt-app-builder". Evaluate a task-management product for ChatGPT.
Expected outcome:
- Fit: strong for user-specific task knowledge and task creation.
- Primary tools: list tasks, create task, and complete task.
- Main blocker: user data and write actions require authentication.
Using "chatgpt-app-builder". Design a widget for viewing and completing tasks.
Expected outcome:
- Use a compact responsive list with status and priority.
- Expose completion as an explicit action with feedback.
- Keep full records in widget metadata and concise summaries in model content.
Using "chatgpt-app-builder". Review an app before deployment.
Expected outcome:
- Require OAuth for user-specific reads and every mutation.
- Restrict production origins and set security headers.
- Run tool, widget, golden-prompt, mobile, and failure-path tests.
Security Audit
High Riskv10 • 7/23/2026 Open versioned report
All 400 static findings were adjudicated. The metadata address is blocked defensively, while other matches are documentation, template literals, configuration reads, or fixed asset paths. The deployable MCP template still needs authentication and restricted CORS before public use. Static review was capped at 400/457 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
43
Files scanned
11,683
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Unauthenticated MCP Tool Invocation
The server creates sessions and accepts tool messages without bearer-token validation. A public deployment could expose read and write tools to unauthorized clients.
The complete request path contains no authorization check before session creation or POST handling. The skill also states that authentication is required for user data and writes.
Medium
Wildcard CORS in Deployable Server Template
The server permits every browser origin on MCP responses and preflight requests. This conflicts with the skill's production guidance to allow ChatGPT origins only.
The response and preflight handlers directly set Access-Control-Allow-Origin to an asterisk. The production checklist explicitly requires restricted ChatGPT origins.
Risk Factors
🌐 Network access (50)
assets/deploy/Dockerfile:42 assets/server/src/index.ts:51 assets/server/src/index.ts:333 assets/server/src/index.ts:336 assets/server/src/index.ts:575 assets/server/src/index.ts:619 assets/server/src/index.ts:620 assets/server/src/index.ts:621 assets/server/src/index.ts:622 assets/server/src/lib/api-client.ts:64 assets/server/src/lib/api-client.ts:53 assets/server/src/lib/image-proxy.ts:36 assets/server/src/lib/image-proxy.ts:126 assets/server/src/lib/image-proxy.ts:65 assets/server/src/lib/image-proxy.ts:55 assets/server/src/lib/image-proxy.ts:65 assets/server/src/tools/example-tool.ts:193 references/chatgpt_app_best_practices.md:220 references/chatgpt_app_best_practices.md:223 references/chatgpt_app_best_practices.md:226 references/chatgpt_app_best_practices.md:229 references/node_chatgpt_app.md:263 references/node_chatgpt_app.md:314 references/node_chatgpt_app.md:384 references/node_chatgpt_app.md:385 references/node_chatgpt_app.md:386 references/node_chatgpt_app.md:542 references/node_chatgpt_app.md:546 references/node_chatgpt_app.md:561 references/node_chatgpt_app.md:566 references/node_chatgpt_app.md:593 references/oauth_integration.md:91 references/oauth_integration.md:53 references/oauth_integration.md:54 references/oauth_integration.md:56 references/oauth_integration.md:71 references/oauth_integration.md:72 references/oauth_integration.md:73 references/oauth_integration.md:74 references/oauth_integration.md:108 references/oauth_integration.md:113 references/oauth_integration.md:127 references/oauth_integration.md:128 references/oauth_integration.md:129 references/oauth_integration.md:139 references/oauth_integration.md:148 references/oauth_integration.md:149 references/oauth_integration.md:358 references/oauth_integration.md:375 references/oauth_integration.md:376
⚙️ External commands (50)
assets/server/scripts/build-widget.ts:58 assets/server/scripts/build-widget.ts:60 assets/server/src/index.ts:67 assets/server/src/index.ts:69 assets/server/src/index.ts:75-95 assets/server/src/index.ts:236 assets/server/src/index.ts:237 assets/server/src/index.ts:248 assets/server/src/index.ts:249 assets/server/src/index.ts:303 assets/server/src/index.ts:384 assets/server/src/index.ts:427 assets/server/src/index.ts:455 assets/server/src/index.ts:463 assets/server/src/index.ts:475 assets/server/src/index.ts:575 assets/server/src/index.ts:619 assets/server/src/index.ts:620 assets/server/src/index.ts:621 assets/server/src/index.ts:622 assets/server/src/lib/api-client.ts:62 assets/server/src/lib/api-client.ts:67 assets/server/src/lib/api-client.ts:75 assets/server/src/lib/api-client.ts:103 assets/server/src/lib/api-client.ts:110 assets/server/src/lib/api-client.ts:123 assets/server/src/lib/api-client.ts:127 assets/server/src/lib/errors.ts:29 assets/server/src/lib/errors.ts:39 assets/server/src/lib/errors.ts:47 assets/server/src/lib/errors.ts:63 assets/server/src/lib/image-proxy.ts:47 assets/server/src/lib/image-proxy.ts:70 assets/server/src/lib/image-proxy.ts:80 assets/server/src/lib/image-proxy.ts:86 assets/server/src/lib/image-proxy.ts:138 assets/server/src/lib/image-proxy.ts:145 assets/server/src/lib/image-proxy.ts:154 assets/server/src/lib/image-proxy.ts:162 assets/server/src/lib/image-proxy.ts:165 assets/server/src/lib/image-proxy.ts:167 assets/server/src/lib/rate-limiter.ts:97 assets/server/src/lib/rate-limiter.ts:116 assets/server/src/lib/rate-limiter.ts:126 assets/server/src/lib/rate-limiter.ts:189 assets/server/src/tools/create-item.ts:70 assets/server/src/tools/example-tool.ts:121 assets/server/src/tools/example-tool.ts:195 assets/server/src/tools/example-tool.ts:201 assets/server/src/tools/example-tool.ts:229
📁 Filesystem access (50)
assets/server/scripts/build-widget.ts:16 assets/server/scripts/build-widget.ts:50 assets/server/scripts/build-widget.ts:54 assets/server/scripts/build-widget.ts:55 assets/server/scripts/build-widget.ts:49 assets/server/scripts/build-widget.ts:50 assets/server/scripts/build-widget.ts:54 assets/server/scripts/build-widget.ts:55 assets/server/src/index.ts:72 assets/server/src/index.ts:73 assets/server/src/index.ts:65 assets/server/src/index.ts:73 assets/server/src/index.ts:72 assets/server/src/index.ts:73 assets/server/src/index.ts:46 assets/server/src/tools/create-item.ts:9 assets/server/src/tools/create-item.ts:10 assets/server/src/tools/get-items.ts:9 assets/server/src/tools/get-items.ts:10 assets/server/src/widget/embed.ts:25 assets/server/src/widget/embed.ts:34 assets/server/src/widget/embed.ts:25 assets/server/src/widget/embed.ts:34 assets/server/src/widget/embed.ts:19 assets/server/src/widget/embed.ts:20 assets/server/src/widget/embed.ts:19 assets/server/src/widget/embed.ts:20 assets/tests/tool-tests.ts:108 references/node_chatgpt_app.md:146 references/node_chatgpt_app.md:147 references/node_chatgpt_app.md:142 references/node_chatgpt_app.md:147 references/node_chatgpt_app.md:146 references/node_chatgpt_app.md:147 references/node_chatgpt_app.md:129 references/oauth_integration.md:49 references/oauth_integration.md:67 references/oauth_integration.md:139 references/oauth_integration.md:164 references/oauth_integration.md:165 references/oauth_integration.md:198 references/oauth_integration.md:206 references/oauth_integration.md:358 references/oauth_integration.md:394 references/oauth_integration.md:415 references/oauth_integration.md:494 references/submission_requirements.md:27 references/submission_requirements.md:35 references/submission_requirements.md:188 references/submission_requirements.md:189
🔑 Env variables (37)
assets/server/scripts/build-widget.ts:24 assets/server/scripts/build-widget.ts:25 assets/server/scripts/build-widget.ts:36 assets/server/scripts/build-widget.ts:37 assets/server/scripts/build-widget.ts:24 assets/server/scripts/build-widget.ts:25 assets/server/scripts/build-widget.ts:36 assets/server/scripts/build-widget.ts:37 assets/server/src/index.ts:49 assets/server/src/index.ts:50 assets/server/src/index.ts:51 assets/server/src/index.ts:565 assets/server/src/index.ts:49 assets/server/src/index.ts:50 assets/server/src/index.ts:51 assets/server/src/index.ts:565 assets/server/src/lib/api-client.ts:53 assets/server/src/lib/api-client.ts:54 assets/server/src/lib/api-client.ts:53 assets/server/src/lib/api-client.ts:54 assets/server/src/tools/example-tool.ts:195 assets/server/src/tools/example-tool.ts:195 references/node_chatgpt_app.md:311 references/node_chatgpt_app.md:311 references/oauth_integration.md:538 references/oauth_integration.md:553 references/oauth_integration.md:538 references/oauth_integration.md:553 references/oauth_integration.md:538 references/security_patterns.md:451 references/security_patterns.md:451 references/testing_patterns.md:127 references/testing_patterns.md:128 references/testing_patterns.md:127 references/testing_patterns.md:128 references/testing_patterns.md:49 references/testing_patterns.md:52
⚡ Contains scripts (1)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/bayramannakov-chatgpt-app-builder/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/bayramannakov-chatgpt-app-builder?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/bayramannakov-chatgpt-app-builder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/bayramannakov-chatgpt-app-builder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/bayramannakov-chatgpt-app-builder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
BayramAnnakov. (2026). chatgpt-app-builder security audit report (audit version 10) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/bayramannakov-chatgpt-app-builder/audits/10BibTeX citation
@techreport{bayramannakov-bayramannakov-chatgpt-app-builder-2026,
author = {BayramAnnakov},
title = {chatgpt-app-builder security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/bayramannakov-chatgpt-app-builder/audits/10},
note = {Author version 1.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "chatgpt-app-builder security audit report (audit version 10)"
version: "1.0.0"
type: report
authors:
- name: "BayramAnnakov"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/bayramannakov-chatgpt-app-builder/audits/10"
identifiers:
- type: other
value: "skillstore:bayramannakov-chatgpt-app-builder:audit:10"
description: "Skillstore immutable audit report identifier"
Compare variants
3 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Highest Skillstore Score
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
mcp-use Recommended
mcp-use-chatgpt-app-builder
Skillstore Score 76
Evidence Confidence High
Skillstore usage 10
Updated
2026-08-21
shubhamsaboo-chatgpt-app-builder
Skillstore Score 67
Evidence Confidence Medium
Skillstore usage 5
Updated
2026-08-21
BayramAnnakov Current
bayramannakov-chatgpt-app-builder
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 82
Architecture
100
Maintainability
87
Content
71
Community
83
Spec Compliance
What You Can Build
Evaluate Product Fit
Assess whether a product offers useful knowledge, actions, or visual experiences inside ChatGPT.
Build an MCP Application
Design tools and implement a TypeScript server with an interactive React widget.
Prepare a Secure Release
Review authentication, testing, deployment, and submission requirements before public launch.
Try These Prompts
Evaluate a Product
Evaluate whether [product] should become a ChatGPT App. Assess Know, Do, and Show value, blockers, and three strong user prompts.
Design the App Specification
Create an app specification for [product]. Define two to five tools, widget needs, authentication, data boundaries, and golden prompts.
Implement the Application
Build the ChatGPT App from [specification]. Customize the MCP server and React widget, validate inputs, add tests, and document required configuration.
Audit Production Readiness
Audit [project] for production. Verify OAuth, authorization, CORS, security headers, rate limits, idempotency, responsive widgets, deployment, and submission requirements.
Best Practices
- Complete the fit evaluation and app specification before generating code.
- Validate every tool input and require authentication for user data or write operations.
- Test tools, widgets, discovery prompts, mobile layouts, and failure paths before submission.
Avoid
- Do not deploy the placeholder server without authentication and origin restrictions.
- Do not place sensitive records in model-visible content when widget metadata is sufficient.
- Do not expose broad tools with overlapping descriptions or unbounded inputs.
Frequently Asked Questions
What does this skill build?
It guides creation of ChatGPT Apps with MCP tools, Node.js servers, React widgets, testing, deployment, and submission preparation.
Does it include working templates?
Yes. It includes server, widget, test, and deployment templates that require product-specific customization.
Is authentication included?
OAuth guidance is included, but the base server template does not enforce authentication. Add token validation before production use.
Which tools can use this skill?
The metadata lists Claude, Codex, and Claude Code as supported tools.
What local software is required?
Use Node.js 18 or newer and npm. Network testing usually uses MCP Inspector and ngrok.
Does the skill submit the app automatically?
No. It prepares the project and submission checklist, but a verified organization must complete review and publication.
Developer Details
Author
BayramAnnakovLicense
MIT
Author version
v1.0.0
Skillstore revision
r2
Ref
8c3e20bba512c392d9b02ee748b18e0b09d4982c
Maintenance freshness
7/24/2026
Usage
7 downloads · 282 views