chatgpt-app-submission
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- Source Code Inspection: The skill is designed to read local project metadata, manifests, and implementation source code. This is the intended behavior for an automated auditing and documentation tool used in a development environment.
- Security Auditing Logic: It includes specific instructions for the agent to flag sensitive data solicitation (such as PHI, PCI, or credentials) and weak Content Security Policies (CSPs). This functions as a security linter for the developer's application.
- Safe Data Handling: The instructions explicitly direct the agent to exclude secrets, credentials, private implementation details, and local paths from the generated submission file and the final summary response.
- Defined Output Contract: The skill writes a single, structured JSON file to the local directory based on a provided schema. It does not perform network operations, execute remote code, or request elevated privileges.
Audit Metadata