chatgpt-apps
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: A test case containing prompt injection patterns was identified in "references/evals.yaml". This is a benign evaluation artifact used to verify the agent's resistance to such attacks and does not constitute a malicious instruction.
- [COMMAND_EXECUTION]: The skill includes a utility script, "scripts/scaffold_node_ext_apps.mjs", which performs local file system operations ("mkdirSync", "writeFileSync") to create project directories and files. This behavior is consistent with the skill's stated purpose as a scaffolding tool.
- [DYNAMIC_EXECUTION]: The scaffolding script dynamically assembles source code and configuration files (such as "package.json" and "server.ts") using predefined templates and user-supplied arguments (app name, tool name). This is standard functionality for project generation tools.
- [EXTERNAL_DOWNLOADS]: The skill references official documentation and examples from trusted sources, including OpenAI's developer portal and the "@modelcontextprotocol" organization, which are appropriate for the intended development tasks.
Audit Metadata