chatgpt-app-builder

Fail

Audited by Runlayer on Feb 27, 2026

Risk Level: HIGH
Scan Summary
Max Score
92%
Files
23
Flagged
8
Chunks
23
Flagged Files (8)
chatgpt-app-builder/references/publish.mdHIGH
91.6%

Malicious tool definition detected

### Claude Guide user to submit the app on the [Anthropic Connectors Directory FAQ](https://support.claude.com/en/articles/11596036-anthropic-connectors-directory-faq).

chatgpt-app-builder/references/deploy.mdMEDIUM
81.3%

Malicious tool definition detected

**Configure**: - **Branch**: pick the branch to deploy from (pushes trigger redeploys) - **Environment variables** - **Build settings**: Alpic auto-detects, verify build command and output directory 5.

chatgpt-app-builder/references/oauth.mdMEDIUM
78.0%

Malicious tool definition detected

Discovery Endpoints Serve two JSON endpoints so the LLM host knows where to authenticate users: ```typescript // index.ts import { mcpAuthMetadataRouter } from "@modelcontextprotocol/sdk/server/auth/router.js"; app.use( mcpAuthMetadataRouter({ oauthMetadata: { issuer: "https://your-oauth-provider.com", authorization_endpoint: "https://your-oauth-provider.com/oauth2/authorize", token_endpoint: "https://your-oauth-provider.com/oauth2/token", response_types_supported: ["code"], grant_types_supporte

chatgpt-app-builder/references/run-locally.mdMEDIUM
77.2%

Malicious tool definition detected

If yes, expose the local server via ngrok: ```bash ngrok http 3000 ``` Extract the forwarding URL from ngrok output (e.g., `https://abc123.ngrok.io`).

chatgpt-app-builder/evals/README.mdLOW
63.9%

Tool passed security scan

chatgpt-app-builder/references/copy-template.mdLOW
60.4%

Tool passed security scan

chatgpt-app-builder/SKILL.mdLOW
52.8%

Tool passed security scan

chatgpt-app-builder/evals/discover.jsonLOW
51.7%

Tool passed security scan

Passed Files (15)Click to expand
chatgpt-app-builder/evals/fetch-and-render-data.jsonOK
36.8%

Tool passed security scan

chatgpt-app-builder/evals/open-external-links.jsonOK
34.5%

Tool passed security scan

chatgpt-app-builder/references/csp.mdOK
32.7%

Tool passed security scan

chatgpt-app-builder/references/ui-guidelines.mdOK
20.9%

Tool passed security scan

chatgpt-app-builder/references/discover.mdOK
16.3%

Tool passed security scan

chatgpt-app-builder/evals/ui-guidelines.jsonOK
12.5%

Tool passed security scan

chatgpt-app-builder/evals/state-and-context.jsonOK
10.6%

Tool passed security scan

chatgpt-app-builder/evals/architecture.jsonOK
10.2%

Tool passed security scan

chatgpt-app-builder/evals/communicate-with-host.jsonOK
10.2%

Tool passed security scan

chatgpt-app-builder/evals/skill.jsonOK
9.0%

Tool passed security scan

chatgpt-app-builder/references/fetch-and-render-data.mdOK
8.4%

Tool passed security scan

chatgpt-app-builder/references/prompt-llm.mdOK
7.5%

Tool passed security scan

chatgpt-app-builder/references/architecture.mdOK
5.4%

Tool passed security scan

chatgpt-app-builder/references/open-external-links.mdOK
4.9%

Tool passed security scan

chatgpt-app-builder/references/state-and-context.mdOK
2.6%

Tool passed security scan

Audit Metadata
Max File Score
92%
Classification
KNOWN_SERVER_ALL_UNKNOWN
Files Scanned
23
Files Flagged
8
Chunks Analyzed
23
Analyzed
Feb 27, 2026, 05:48 PM
Security Audit — runlayer — chatgpt-app-builder