chatgpt-apps
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a utility script
scripts/scaffold_node_ext_apps.mjsthat is executed locally to generate project files (package.json, tsconfig.json, widget HTML, and server TypeScript). The script implements input sanitization using regex-based slugification for app and tool names, mitigating common command injection risks. - [EXTERNAL_DOWNLOADS]: Instructions direct the agent to fetch documentation and example code from official OpenAI developer portals (developers.openai.com) and the official OpenAI GitHub organization. These are well-known, trusted sources for development resources.
- [COMMAND_EXECUTION]: The documentation workflow suggests using
ngrokto create HTTPS tunnels for local development and testing with ChatGPT. This is a standard industry practice for developing and debugging webhooks and local API servers.
Audit Metadata