prepare-chatgpt-app-submission
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill uses natural instructional language to define guardrails. It explicitly instructs the agent to ignore its own memory of schemas and instead rely on official tools and current repository state. These instructions serve as safety constraints rather than attempts to bypass platform security.
- [DATA_EXFILTRATION]: The skill contains multiple proactive instructions to prevent data exposure. It specifically mandates that no tokens, credentials, account identifiers, private paths, or customer data be included in the generated JSON. It also instructs the agent not to commit the submission file to public repositories or expose its full contents in chat logs.
- [EXTERNAL_DOWNLOADS]: The skill references official documentation URLs from OpenAI (
help.openai.com,developers.openai.com). These are well-known, trusted services used for informational purposes and do not trigger unauthorized downloads or code execution. - [COMMAND_EXECUTION]: While the skill logic involves inspecting a repository (likely using filesystem or git tools), it does not provide arbitrary shell commands or spawn unsafe subprocesses. It delegates complex logic to the official
chatgpt-app-submissionskill. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted repository data (MCP server implementations). It mitigates this risk by requiring the agent to inspect real implementations rather than just reading descriptions, and by enforcing a mandatory review workflow that identifies sensitive inputs or ambiguous tool behaviors before any output is finalized.
Audit Metadata