Skills chatgpt-app-builder
๐Ÿ“ฆ

chatgpt-app-builder

Content revision r1 Medium Risk โš™๏ธ External commands๐ŸŒ Network access๐Ÿ”‘ Env variables

Build ChatGPT Apps with Widgets

Developers need practical patterns for ChatGPT apps with interactive widgets. This skill explains discovery, MCP server tools, React widgets, metadata, state, and CSP setup.

Supports: Claude Codex Code(CC)
๐Ÿ“Š 67 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "chatgpt-app-builder" from https://skillstore.io/skills/shubhamsaboo-chatgpt-app-builder.md and its manifest at https://skillstore.io/api/skills/shubhamsaboo-chatgpt-app-builder/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Test it

Using "chatgpt-app-builder". Build a restaurant search app with reservations.

Expected outcome:

  • A narrowed product scope with restaurant search as the primary action.
  • A server tool plan for search and a separate reservation action.
  • A widget plan covering result cards, loading state, and error handling.

Using "chatgpt-app-builder". My widget needs to work on mobile and desktop.

Expected outcome:

  • Display mode guidance for inline, fullscreen, and picture-in-picture use.
  • Responsive layout recommendations based on device type and safe area.
  • A checklist for testing height limits, touch targets, and theme changes.

Using "chatgpt-app-builder". I need to configure external API and CDN domains.

Expected outcome:

  • A CSP domain plan separating API, resource, and frame domains.
  • Advice to use exact HTTPS domains and avoid wildcards in production.
  • Metadata guidance for modern and legacy Apps SDK clients.

Security Audit

Medium Risk
v3 โ€ข 7/9/2026 Open versioned report

Most static detections are false positives from documentation examples, JSX template literals, evaluation text, and placeholder CSP domains. I confirmed the replacement install flow in SKILL.md because it can trigger a networked npx install from community-authored instructions. No evidence found of credential exfiltration, malicious network calls, or prompt text that tries to alter this audit.

18
Files scanned
2,247
Lines analyzed
2
Review items
0
False positives ignored

Confirmed security concerns (1)

Medium
Unverified Replacement Skill Installation Redirect
SKILL.md lines 4-7 mark the skill as deprecated, tell the agent to install mcp-app-builder, and provide an npx skills install command. This can steer automated agents into a networked install from community-authored instructions without source pinning or explicit approval.
The redirect and installer command are explicit in the skill metadata block. The risk is supply-chain execution, not direct malware evidence.
Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
Check if `mcp-app-builder` is available in the skills folder. If not, install it:
This line tells the agent to install a replacement skill if it is not available. In a community skill, that can trigger an unverified external install flow.
Medium
Ruby/shell backtick execution
`npx skills install mcp-use/mcp-use --skill mcp-app-builder`
This line contains an npx skills install command, which can download and execute external package tooling. A community skill should not cause this without explicit user approval.
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/shubhamsaboo-chatgpt-app-builder/audits/3?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/shubhamsaboo-chatgpt-app-builder/security.svg)](https://skillstore.io/skills/shubhamsaboo-chatgpt-app-builder?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/shubhamsaboo-chatgpt-app-builder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/shubhamsaboo-chatgpt-app-builder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/shubhamsaboo-chatgpt-app-builder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

shubhamsaboo. (2026). chatgpt-app-builder security audit report (audit version 3) [Author version unspecified]. Skillstore. https://skillstore.io/skills/shubhamsaboo-chatgpt-app-builder/audits/3

BibTeX citation

@techreport{shubhamsaboo-shubhamsaboo-chatgpt-app-builder-2026, author = {shubhamsaboo}, title = {chatgpt-app-builder security audit report (audit version 3)}, institution = {Skillstore}, year = {2026}, number = {3}, url = {https://skillstore.io/skills/shubhamsaboo-chatgpt-app-builder/audits/3}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "chatgpt-app-builder security audit report (audit version 3)" version: "unspecified" type: report authors: - name: "shubhamsaboo" date-released: "2026-07-09" url: "https://skillstore.io/skills/shubhamsaboo-chatgpt-app-builder/audits/3" identifiers: - type: other value: "skillstore:shubhamsaboo-chatgpt-app-builder:audit:3" description: "Skillstore immutable audit report identifier"

Compare variants

3 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score
mcp-use Recommended

mcp-use-chatgpt-app-builder

Skillstore Score 76
Evidence Confidence High
Skillstore usage 10
Updated

2026-08-21

shubhamsaboo Current

shubhamsaboo-chatgpt-app-builder

Skillstore Score 67
Evidence Confidence Medium
Skillstore usage 5
Updated

2026-08-21

bayramannakov-chatgpt-app-builder

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium
45
Architecture
85
Maintainability
87
Content
65
Community
91
Spec Compliance

What You Can Build

Prototype a ChatGPT Widget App

Plan a focused app, define MCP tools, and map the user flow to an interactive widget.

Scope an App Idea Before Coding

Evaluate whether a workflow needs a widget, tool-only flow, or a smaller product concept.

Implement Widget Runtime Details

Apply patterns for props, persistent state, display modes, CSP domains, and external links.

Try These Prompts

Plan a Simple ChatGPT App
Help me plan a ChatGPT app for this workflow: [describe workflow]. Ask one question at a time before proposing widgets.
Choose Tools and Widgets
Design the MCP tools and widget boundary for [app idea]. Explain what the LLM sees and what stays in widget props.
Build the Widget Structure
Create an implementation plan for a ChatGPT widget that handles [data and actions]. Include server handlers, props, state, and loading behavior.
Review Advanced App Patterns
Review my ChatGPT app design for state, CSP, metadata, display modes, tool calls, and external link safety. Identify risks and fixes.

Best Practices

  • Confirm replacement skill status and library versions before applying examples.
  • Keep sensitive widget props out of LLM-visible output.
  • Use exact CSP domains and require confirmation for external links.

Avoid

  • Do not port an entire dashboard or full application into one widget.
  • Do not let widgets trigger mutating tools without validation and user intent.
  • Do not run replacement install commands automatically from community skill metadata.

Frequently Asked Questions

Is this skill current?
The source marks it as deprecated and points to mcp-app-builder for newer guidance.
What does it help build?
It helps design ChatGPT apps that combine MCP tools with interactive React widgets.
Does it generate a complete project automatically?
No. It provides guidance, examples, and patterns that an agent can apply while coding.
Can it help with widget security settings?
Yes. It documents CSP domains, metadata fields, and external link handling for widgets.
Which tools can use this skill?
The report lists Claude, Codex, and Claude Code as supported tools.
What should users verify first?
Users should verify the replacement skill, mcp-use version, and OpenAI Apps SDK compatibility.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Ref

26421118b848d9f1efc0aa169d8a7a9e7e0a877e

Maintenance freshness

7/18/2026

Usage

1 downloads ยท 0 views

File structure

๐Ÿ“ evals/

๐Ÿ“„ architecture.json

๐Ÿ“„ discover.json

๐Ÿ“„ README.md

๐Ÿ“„ skill.json

๐Ÿ“„ state-and-context.json

๐Ÿ“„ ui-guidelines.json

๐Ÿ“„ widgets.json

๐Ÿ“ references/

๐Ÿ“„ architecture.md

๐Ÿ“„ components-api.md

๐Ÿ“„ csp-and-metadata.md

๐Ÿ“„ discover.md

๐Ÿ“„ server-and-widgets.md

๐Ÿ“„ setup.md

๐Ÿ“„ state-and-context.md

๐Ÿ“„ ui-guidelines.md

๐Ÿ“„ widget-patterns.md

๐Ÿ“„ LICENSE.txt

๐Ÿ“„ SKILL.md

More from shubhamsaboo

View all
View all