Skills chatgpt-app-builder

📦

chatgpt-app-builder

Name: chatgpt-app-builder
Author: shubhamsaboo

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access🔑 Env variables

Build ChatGPT Apps with Widgets

Developers need practical patterns for ChatGPT apps with interactive widgets. This skill explains discovery, MCP server tools, React widgets, metadata, state, and CSP setup.

Supports: Claude Codex Code(CC)

📊 67 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "chatgpt-app-builder" from https://skillstore.io/skills/shubhamsaboo-chatgpt-app-builder.md and its manifest at https://skillstore.io/api/skills/shubhamsaboo-chatgpt-app-builder/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/shubhamsaboo-chatgpt-app-builder.md Signed manifest GET /api/skills/shubhamsaboo-chatgpt-app-builder/manifest Signed lockfile GET /api/skills/shubhamsaboo-chatgpt-app-builder/lockfile

Test it

Using "chatgpt-app-builder". Build a restaurant search app with reservations.

Expected outcome:

A narrowed product scope with restaurant search as the primary action.
A server tool plan for search and a separate reservation action.
A widget plan covering result cards, loading state, and error handling.

Using "chatgpt-app-builder". My widget needs to work on mobile and desktop.

Expected outcome:

Display mode guidance for inline, fullscreen, and picture-in-picture use.
Responsive layout recommendations based on device type and safe area.
A checklist for testing height limits, touch targets, and theme changes.

Using "chatgpt-app-builder". I need to configure external API and CDN domains.

Expected outcome:

A CSP domain plan separating API, resource, and frame domains.
Advice to use exact HTTPS domains and avoid wildcards in production.
Metadata guidance for modern and legacy Apps SDK clients.

Security Audit

Medium Risk

v3 • 7/9/2026 Open versioned report

Most static detections are false positives from documentation examples, JSX template literals, evaluation text, and placeholder CSP domains. I confirmed the replacement install flow in SKILL.md because it can trigger a networked npx install from community-authored instructions. No evidence found of credential exfiltration, malicious network calls, or prompt text that tries to alter this audit.

Files scanned

2,247

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:4-7

Unverified Replacement Skill Installation Redirect

SKILL.md lines 4-7 mark the skill as deprecated, tell the agent to install mcp-app-builder, and provide an npx skills install command. This can steer automated agents into a networked install from community-authored instructions without source pinning or explicit approval.

The redirect and installer command are explicit in the skill metadata block. The risk is supply-chain execution, not direct malware evidence.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:5

Ruby/shell backtick execution

Check if `mcp-app-builder` is available in the skills folder. If not, install it:

This line tells the agent to install a replacement skill if it is not available. In a community skill, that can trigger an unverified external install flow.

Medium

SKILL.md:6

Ruby/shell backtick execution

`npx skills install mcp-use/mcp-use --skill mcp-app-builder`

This line contains an npx skills install command, which can download and execute external package tooling. A community skill should not cause this without explicit user approval.

Risk Factors

⚙️ External commands (12)

references/architecture.md:105-124 references/architecture.md:154-157 references/components-api.md:96-101 references/server-and-widgets.md:58-63 references/state-and-context.md:260-270 references/widget-patterns.md:202-205 references/widget-patterns.md:205-218 SKILL.md:4 SKILL.md:5 SKILL.md:6 SKILL.md:7 SKILL.md:40-55

🌐 Network access (15)

🔑 Env variables (2)

references/server-and-widgets.md:29 references/server-and-widgets.md:29

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/shubhamsaboo-chatgpt-app-builder/audits/3?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/shubhamsaboo-chatgpt-app-builder/security.svg)](https://skillstore.io/skills/shubhamsaboo-chatgpt-app-builder?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/shubhamsaboo-chatgpt-app-builder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/shubhamsaboo-chatgpt-app-builder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/shubhamsaboo-chatgpt-app-builder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

shubhamsaboo. (2026). chatgpt-app-builder security audit report (audit version 3) [Author version unspecified]. Skillstore. https://skillstore.io/skills/shubhamsaboo-chatgpt-app-builder/audits/3

BibTeX citation

@techreport{shubhamsaboo-shubhamsaboo-chatgpt-app-builder-2026,
  author = {shubhamsaboo},
  title = {chatgpt-app-builder security audit report (audit version 3)},
  institution = {Skillstore},
  year = {2026},
  number = {3},
  url = {https://skillstore.io/skills/shubhamsaboo-chatgpt-app-builder/audits/3},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "chatgpt-app-builder security audit report (audit version 3)"
version: "unspecified"
type: report
authors:
  - name: "shubhamsaboo"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/shubhamsaboo-chatgpt-app-builder/audits/3"
identifiers:
  - type: other
    value: "skillstore:shubhamsaboo-chatgpt-app-builder:audit:3"
    description: "Skillstore immutable audit report identifier"

Compare variants

4 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

mcp-use Recommended

mcp-use-chatgpt-app-builder

Skillstore Score 76

Evidence Confidence High

Skillstore usage 10

Updated

2026-09-09

alpic-ai

alpic-ai-chatgpt-app-builder

Skillstore Score 75

Evidence Confidence Medium

Skillstore usage 1

Updated

2026-09-22

shubhamsaboo Current

shubhamsaboo-chatgpt-app-builder

Skillstore Score 67

Evidence Confidence Medium

Skillstore usage 5

Updated

2026-09-09

BayramAnnakov

bayramannakov-chatgpt-app-builder

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-09-09

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Prototype a ChatGPT Widget App

Plan a focused app, define MCP tools, and map the user flow to an interactive widget.

Scope an App Idea Before Coding

Evaluate whether a workflow needs a widget, tool-only flow, or a smaller product concept.

Implement Widget Runtime Details

Apply patterns for props, persistent state, display modes, CSP domains, and external links.

Try These Prompts

Plan a Simple ChatGPT App

Help me plan a ChatGPT app for this workflow: [describe workflow]. Ask one question at a time before proposing widgets.

Choose Tools and Widgets

Design the MCP tools and widget boundary for [app idea]. Explain what the LLM sees and what stays in widget props.

Build the Widget Structure

Create an implementation plan for a ChatGPT widget that handles [data and actions]. Include server handlers, props, state, and loading behavior.

Review Advanced App Patterns

Review my ChatGPT app design for state, CSP, metadata, display modes, tool calls, and external link safety. Identify risks and fixes.

Best Practices

Confirm replacement skill status and library versions before applying examples.
Keep sensitive widget props out of LLM-visible output.
Use exact CSP domains and require confirmation for external links.

Avoid

Do not port an entire dashboard or full application into one widget.
Do not let widgets trigger mutating tools without validation and user intent.
Do not run replacement install commands automatically from community skill metadata.