Skills chatgpt-app-builder
๐Ÿ“ฆ

chatgpt-app-builder

Content revision r1 Safe โš™๏ธ External commands๐ŸŒ Network access๐Ÿ”‘ Env variables

Build ChatGPT Apps with MCP Widgets

ChatGPT app builders need clear patterns for MCP servers, widget state, and Apps SDK metadata. This deprecated skill provides mcp-use references and migration guidance for interactive widget projects.

Supports: Claude Codex Code(CC)
๐Ÿ“Š 76 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "chatgpt-app-builder" from https://skillstore.io/skills/mcp-use-chatgpt-app-builder.md and its manifest at https://skillstore.io/api/skills/mcp-use-chatgpt-app-builder/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Test it

Using "chatgpt-app-builder". I want a restaurant reservation app inside ChatGPT.

Expected outcome:

A discovery brief that identifies the user goal, required API access, widget need, core reservation actions, and next architecture questions.

Using "chatgpt-app-builder". My product search widget needs filters and refresh actions.

Expected outcome:

A widget plan that separates the search server tool, product list widget, filter state, refresh tool call, and loading behavior.

Using "chatgpt-app-builder". I need to migrate legacy Apps SDK metadata.

Expected outcome:

A migration checklist covering unified metadata, CSP domains, ChatGPT-specific fields, widget descriptions, and testing steps.

Security Audit

Safe
v6 โ€ข 7/9/2026 Open versioned report

Most static detections are false positives from Markdown examples, template literals, placeholder URLs, UI guidance, and non-secret environment variable examples. One medium issue is confirmed: the deprecated skill front matter includes an executable npx install command for a replacement skill, which could trigger external installation in untrusted contexts. No prompt injection, credential exfiltration, or malicious intent was found.

18
Files scanned
2,127
Lines analyzed
1
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
`npx skills install mcp-use/mcp-use --skill mcp-app-builder`
This line contains an executable npx command in the skill front matter that instructs installation of another skill. In an untrusted marketplace skill, that can trigger external code retrieval or supply-chain exposure if followed automatically.
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/mcp-use-chatgpt-app-builder/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/mcp-use-chatgpt-app-builder/security.svg)](https://skillstore.io/skills/mcp-use-chatgpt-app-builder?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/mcp-use-chatgpt-app-builder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/mcp-use-chatgpt-app-builder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/mcp-use-chatgpt-app-builder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

mcp-use. (2026). chatgpt-app-builder security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/mcp-use-chatgpt-app-builder/audits/6

BibTeX citation

@techreport{mcp-use-mcp-use-chatgpt-app-builder-2026, author = {mcp-use}, title = {chatgpt-app-builder security audit report (audit version 6)}, institution = {Skillstore}, year = {2026}, number = {6}, url = {https://skillstore.io/skills/mcp-use-chatgpt-app-builder/audits/6}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "chatgpt-app-builder security audit report (audit version 6)" version: "unspecified" type: report authors: - name: "mcp-use" date-released: "2026-07-09" url: "https://skillstore.io/skills/mcp-use-chatgpt-app-builder/audits/6" identifiers: - type: other value: "skillstore:mcp-use-chatgpt-app-builder:audit:6" description: "Skillstore immutable audit report identifier"

Compare variants

3 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score
mcp-use Recommended Current

mcp-use-chatgpt-app-builder

Skillstore Score 76
Evidence Confidence High
Skillstore usage 10
Updated

2026-08-21

shubhamsaboo-chatgpt-app-builder

Skillstore Score 67
Evidence Confidence Medium
Skillstore usage 5
Updated

2026-08-21

bayramannakov-chatgpt-app-builder

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High
45
Architecture
85
Maintainability
87
Content
69
Community
91
Spec Compliance

What You Can Build

Plan a ChatGPT App Concept

Validate whether an idea needs a ChatGPT app, a widget, or a simpler website or tool flow.

Implement MCP Widget Flows

Use mcp-use examples to connect server tools, React widgets, widget props, and LLM-visible output.

Review Apps SDK Compatibility

Check widget metadata, CSP domains, display modes, and legacy Apps SDK fields during migration.

Try These Prompts

Validate an App Idea
Help me decide whether this idea should be a ChatGPT app. Ask one question at a time and identify the core user action.
Design Tool and Widget Boundaries
Design the MCP tools and widgets for this ChatGPT app. Separate tool-only flows from flows that need an interactive widget.
Build a Widget Flow
Create an implementation plan for a mcp-use server tool and React widget. Include props, output, loading state, and tool calls.
Audit Metadata and State
Review this ChatGPT app design for widget state, LLM-visible context, CSP metadata, display modes, and Apps SDK compatibility.

Best Practices

  • Start with the user action and decide whether the flow needs UI before designing widgets.
  • Keep sensitive or detailed data in widget props and expose only useful summaries to the LLM output.
  • Use exact CSP domains, clear widget metadata, loading states, and explicit error handling.

Avoid

  • Do not port a full dashboard or large website into ChatGPT without narrowing the core tasks.
  • Do not expose private data in LLM-visible output when widget props can hold it instead.
  • Do not rely on placeholder URLs, broad CSP wildcards, or automatic install commands in production guidance.

Frequently Asked Questions

Is this skill current?
No. The source marks it as deprecated and says new projects should use mcp-app-builder.
What does this skill help build?
It helps design ChatGPT apps that use MCP server tools and interactive React widgets with mcp-use.
Does it generate a complete app automatically?
No. It provides patterns, examples, and review guidance that an assistant can apply during implementation.
Can it help with Apps SDK metadata?
Yes. It documents CSP fields, widget metadata, legacy Apps SDK metadata, and migration patterns.
Does it support Claude, Codex, and Claude Code?
Yes. The report lists support for Claude, Codex, and Claude Code.
What should I verify before publishing an app?
Verify authentication, allowed domains, data visibility, widget loading states, error handling, and any external install steps.

Developer Details

Author

mcp-use

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Ref

0519034dad657fb1f7706e0550e962beeda73fdf

Maintenance freshness

7/18/2026

Usage

5 downloads ยท 141 views

File structure

๐Ÿ“ evals/

๐Ÿ“„ architecture.json

๐Ÿ“„ discover.json

๐Ÿ“„ README.md

๐Ÿ“„ skill.json

๐Ÿ“„ state-and-context.json

๐Ÿ“„ ui-guidelines.json

๐Ÿ“„ widgets.json

๐Ÿ“ references/

๐Ÿ“„ architecture.md

๐Ÿ“„ components-api.md

๐Ÿ“„ csp-and-metadata.md

๐Ÿ“„ discover.md

๐Ÿ“„ server-and-widgets.md

๐Ÿ“„ setup.md

๐Ÿ“„ state-and-context.md

๐Ÿ“„ ui-guidelines.md

๐Ÿ“„ widget-patterns.md

๐Ÿ“„ LICENSE.txt

๐Ÿ“„ SKILL.md

More from mcp-use

View all
View all