chatgpt-apps
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill includes a Node.js utility script (
scripts/scaffold_node_ext_apps.mjs) that generates application code, including a server and a widget UI. This script performs file system operations such as directory creation and file writing based on sanitized user inputs. - [COMMAND_EXECUTION]: The agent is instructed to execute the local scaffolding script to create project structures. This execution is intended for project initialization and uses path resolution to manage output locations.
- [INDIRECT_PROMPT_INJECTION]: The skill outlines a pattern where the generated widget UI renders data from tool outputs (
structuredContent). This establishes a data ingestion surface where external content is processed and displayed in the user interface. - [EXTERNAL_DOWNLOADS]: The skill integrates with an MCP tool (
openaiDeveloperDocs) to fetch documentation from OpenAI's official developer portal to ensure generated code remains aligned with current SDK requirements. This utilizes a well-known and trusted source for technical guidance.
Audit Metadata