Skills chatgpt-app-builder Audit History
📦

Audit History

chatgpt-app-builder - 6 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v6 LatestJul 9, 2026, 11:45 AM No confirmed findings1No capability change
v5 Jul 9, 2026, 11:45 AM No confirmed findings1No capability change
v4 Jul 5, 2026, 08:32 PM No confirmed findings1No capability change
v3 Jul 5, 2026, 08:32 PM No confirmed findings1No capability change
v2 Jun 30, 2026, 08:08 AM 2 confirmed1External commandsNetwork accessEnv variables
v1 Feb 22, 2026, 08:40 AM 1 confirmed0Baseline
Audit version 6 Latest

Jul 9, 2026, 11:45 AM

Most static detections are false positives from Markdown examples, template literals, placeholder URLs, UI guidance, and non-secret environment variable examples. One medium issue is confirmed: the deprecated skill front matter includes an executable npx install command for a replacement skill, which could trigger external installation in untrusted contexts. No prompt injection, credential exfiltration, or malicious intent was found.

18
Files scanned
2,127
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
SKILL.md:6
Ruby/shell backtick execution
`npx skills install mcp-use/mcp-use --skill mcp-app-builder`
This line contains an executable npx command in the skill front matter that instructs installation of another skill. In an untrusted marketplace skill, that can trigger external code retrieval or supply-chain exposure if followed automatically.

Risk Factors

⚙️ External commands (12)
references/architecture.md:95-110 references/architecture.md:133-135 references/components-api.md:96-101 references/server-and-widgets.md:57-61 references/state-and-context.md:234-242 references/widget-patterns.md:202-204 references/widget-patterns.md:204-214 SKILL.md:4 SKILL.md:5 SKILL.md:6 SKILL.md:7 SKILL.md:40-55
🌐 Network access (14)
references/components-api.md:281 references/csp-and-metadata.md:22 references/csp-and-metadata.md:23 references/csp-and-metadata.md:26 references/csp-and-metadata.md:29 references/csp-and-metadata.md:65 references/csp-and-metadata.md:66 references/csp-and-metadata.md:87 references/csp-and-metadata.md:88 references/csp-and-metadata.md:119 references/csp-and-metadata.md:120 references/csp-and-metadata.md:123 references/csp-and-metadata.md:154 references/server-and-widgets.md:29
🔑 Env variables (2)
references/server-and-widgets.md:29 references/server-and-widgets.md:29
Audited by: codex
Audit version 5

Jul 9, 2026, 11:45 AM

Most static detections are false positives from Markdown examples, template literals, placeholder URLs, UI guidance, and non-secret environment variable examples. One medium issue is confirmed: the deprecated skill front matter includes an executable npx install command for a replacement skill, which could trigger external installation in untrusted contexts. No prompt injection, credential exfiltration, or malicious intent was found.

18
Files scanned
2,127
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
SKILL.md:6
Ruby/shell backtick execution
`npx skills install mcp-use/mcp-use --skill mcp-app-builder`
This line contains an executable npx command in the skill front matter that instructs installation of another skill. In an untrusted marketplace skill, that can trigger external code retrieval or supply-chain exposure if followed automatically.

Risk Factors

⚙️ External commands (12)
references/architecture.md:95-110 references/architecture.md:133-135 references/components-api.md:96-101 references/server-and-widgets.md:57-61 references/state-and-context.md:234-242 references/widget-patterns.md:202-204 references/widget-patterns.md:204-214 SKILL.md:4 SKILL.md:5 SKILL.md:6 SKILL.md:7 SKILL.md:40-55
🌐 Network access (14)
references/components-api.md:281 references/csp-and-metadata.md:22 references/csp-and-metadata.md:23 references/csp-and-metadata.md:26 references/csp-and-metadata.md:29 references/csp-and-metadata.md:65 references/csp-and-metadata.md:66 references/csp-and-metadata.md:87 references/csp-and-metadata.md:88 references/csp-and-metadata.md:119 references/csp-and-metadata.md:120 references/csp-and-metadata.md:123 references/csp-and-metadata.md:154 references/server-and-widgets.md:29
🔑 Env variables (2)
references/server-and-widgets.md:29 references/server-and-widgets.md:29
Audited by: codex
Audit version 4

Jul 5, 2026, 08:32 PM

Most static hits are false positives from Markdown documentation and TypeScript template literals. The only confirmed issue is the deprecated SKILL.md instruction that asks users to run an npx skills install command. No prompt injection or data exfiltration intent was found.

18
Files scanned
2,127
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
SKILL.md:6
Ruby/shell backtick execution
`npx skills install mcp-use/mcp-use --skill mcp-app-builder`
The skill description includes a concrete npx skills install command for a replacement skill. It is not auto-executed, but it can prompt networked command execution and supply-chain exposure.

Risk Factors

⚙️ External commands (12)
references/architecture.md:95-110 references/architecture.md:133-135 references/components-api.md:96-101 references/server-and-widgets.md:57-61 references/state-and-context.md:234-242 references/widget-patterns.md:202-204 references/widget-patterns.md:204-214 SKILL.md:4 SKILL.md:5 SKILL.md:6 SKILL.md:7 SKILL.md:40-55
🌐 Network access (14)
references/components-api.md:281 references/csp-and-metadata.md:22 references/csp-and-metadata.md:23 references/csp-and-metadata.md:26 references/csp-and-metadata.md:29 references/csp-and-metadata.md:65 references/csp-and-metadata.md:66 references/csp-and-metadata.md:87 references/csp-and-metadata.md:88 references/csp-and-metadata.md:119 references/csp-and-metadata.md:120 references/csp-and-metadata.md:123 references/csp-and-metadata.md:154 references/server-and-widgets.md:29
🔑 Env variables (2)
references/server-and-widgets.md:29 references/server-and-widgets.md:29
Audited by: codex
Audit version 3

Jul 5, 2026, 08:32 PM

Most static hits are false positives from Markdown documentation and TypeScript template literals. The only confirmed issue is the deprecated SKILL.md instruction that asks users to run an npx skills install command. No prompt injection or data exfiltration intent was found.

18
Files scanned
2,127
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
SKILL.md:6
Ruby/shell backtick execution
`npx skills install mcp-use/mcp-use --skill mcp-app-builder`
The skill description includes a concrete npx skills install command for a replacement skill. It is not auto-executed, but it can prompt networked command execution and supply-chain exposure.

Risk Factors

⚙️ External commands (12)
references/architecture.md:95-110 references/architecture.md:133-135 references/components-api.md:96-101 references/server-and-widgets.md:57-61 references/state-and-context.md:234-242 references/widget-patterns.md:202-204 references/widget-patterns.md:204-214 SKILL.md:4 SKILL.md:5 SKILL.md:6 SKILL.md:7 SKILL.md:40-55
🌐 Network access (14)
references/components-api.md:281 references/csp-and-metadata.md:22 references/csp-and-metadata.md:23 references/csp-and-metadata.md:26 references/csp-and-metadata.md:29 references/csp-and-metadata.md:65 references/csp-and-metadata.md:66 references/csp-and-metadata.md:87 references/csp-and-metadata.md:88 references/csp-and-metadata.md:119 references/csp-and-metadata.md:120 references/csp-and-metadata.md:123 references/csp-and-metadata.md:154 references/server-and-widgets.md:29
🔑 Env variables (2)
references/server-and-widgets.md:29 references/server-and-widgets.md:29
Audited by: codex
Audit version 2

Jun 30, 2026, 08:08 AM

Static analysis reported many high-severity patterns, but review found they are mostly Markdown examples, API names, code fences, and license text rather than executable malicious code. The confirmed risk is legitimate developer guidance that may run npm/npx commands, start tunnels, use external URLs, and read environment-driven configuration. No prompt injection, credential exfiltration, obfuscation, or confirmed malicious intent was found.

18
Files scanned
2,127
Lines analyzed
6
Review items
3
False positives ignored

Confirmed security concerns (2)

Medium
SKILL.md:4-7references/setup.md:7-10references/setup.md:55-59references/setup.md:81-84
Developer Command Execution Guidance
The skill instructs agents and users to install skills, scaffold projects, install packages, start tunnels, and deploy apps. This is expected for an app-builder skill, but commands can change the filesystem, install dependencies, and expose a local service if executed without review.
The command examples are explicit and semantically relevant to the skill. They are legitimate development commands, not evidence of malicious intent.
Medium
references/setup.md:36-42references/setup.md:55-64references/csp-and-metadata.md:22-32references/components-api.md:275-284
External Network and Tunnel Configuration
The references guide users to local MCP endpoints, tunnels, external checkout links, and CSP allowlists for third-party domains. This is legitimate for ChatGPT apps, but it increases review requirements for network exposure and data sharing.
The network behavior is directly documented and expected for app integration. The reviewed files do not show credential exfiltration or hidden destinations.
Needs review findings (1)

These findings came from uncertain legacy audit verdicts, so they require review but are not counted as confirmed security issues.

Low
references/server-and-widgets.md:26-30references/csp-and-metadata.md:70-72
Environment Configuration Examples
The skill shows environment-based URL configuration for MCP base URLs and optional CSP domains. This is common configuration guidance, but users should avoid placing secrets in generated client-visible metadata or logs.
The examples access environment-driven configuration, but only for URLs and CSP domains. No evidence found that secrets are read or transmitted.
Static false positives ignored (3)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
evals/architecture.json:19-20references/architecture.md:3LICENSE.txt:25
Weak Cryptography Alerts Are False Positives
Static findings labeled weak cryptography occur in documentation, evaluation text, and license prose. The reviewed files contain no executable cryptographic algorithm selection or hashing implementation.
The cited locations are prose or eval expected behavior, not executable crypto code. No evidence found of MD5, SHA1, DES, or similar usage in runtime code.
Low
evals/README.md:9-16references/server-and-widgets.md:49-58references/state-and-context.md:233-235
Backtick Execution Alerts Are Markdown and JavaScript Examples
Many Ruby backtick alerts are Markdown fences, inline code, or JavaScript template strings inside documentation. They are not Ruby shell execution and are not packaged runtime code.
The reviewed locations are documentation snippets and fenced examples. No Ruby source file or shell backtick execution was found.
Low
references/components-api.md:172-189references/ui-guidelines.md:139-151references/ui-guidelines.md:168-190
System Reconnaissance Alerts Are Responsive UI Context
The system-reconnaissance findings correspond to widget host context such as device type, safe area, locale, and display mode. This supports responsive UI behavior and is documented as part of the widget API.
The context is limited to documented widget environment fields. No evidence found of OS probing, file enumeration, or unauthorized host reconnaissance.

Risk Factors

⚙️ External commands (5)
SKILL.md:4-7 references/setup.md:7-10 references/setup.md:55-59 references/setup.md:81-84 evals/README.md:20-23
🌐 Network access (5)
references/setup.md:36-42 references/setup.md:55-64 references/csp-and-metadata.md:22-32 references/csp-and-metadata.md:49-53 references/components-api.md:275-284
🔑 Env variables (2)
references/server-and-widgets.md:26-30 references/csp-and-metadata.md:70-72
Audited by: codex
Audit version 1

Feb 22, 2026, 08:40 AM

This skill is documentation/reference material for building ChatGPT apps with mcp-use. All static analyzer findings are false positives: (1) 'Weak cryptographic algorithm' triggers on 'sha' substring in words like 'shape' - no actual crypto usage; (2) 'Ruby/shell backtick execution' detects markdown code fences, not shell commands; (3) 'System reconnaissance' and 'Hardcoded URL' are documentation patterns; (4) The critical heuristic 'Code execution + Network + Credential access' is triggered by documentation showing code examples with URLs and environment variables - standard documentation practice, not malicious behavior. This skill contains no executable code.

18
Files scanned
2,127
Lines analyzed
1
Review items
1
False positives ignored

Confirmed security concerns (1)

Low
references/server-and-widgets.md:29
Environment Variable Access in Code Examples
Documentation shows process.env usage (e.g., process.env.MCP_URL). This is standard configuration pattern in code examples, not credential exfiltration.
Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
references/setup.md:37-38references/csp-and-metadata.md:22-23
Hardcoded URLs in Documentation
URLs appear in documentation files (references/setup.md, references/csp-and-metadata.md). These are legitimate API endpoint references in documentation, not security issues.
Audited by: claude
← Back to Skill