chatgpt-app-builder

Warn

Audited by Runlayer on Feb 22, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
78%
Files
2
Flagged
2
Chunks
6
Flagged Files (2)
LICENSE.txtHIGH
78.3%

Malicious tool definition detected

Tool: LICENSE.txt [1/2] Description: Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1.

Tool: LICENSE.txt [2/2] Description: this License.

SKILL.mdHIGH
78.3%

Malicious tool definition detected

Tool: SKILL.md [1/4] Description: --- name: chatgpt-app-builder description: Build ChatGPT apps with interactive widgets using mcp-use and OpenAI Apps SDK.

Tool: SKILL.md [2/4] Description: development before deploying ## Metadata Configuration Options ### Modern Unified Approach (Recommended) Use the `metadata` field for dual-protocol support: ```typescript export const widgetMetadata: WidgetMetadata = { description: "Weather widget", props: propSchema, metadata: { // Works for BOTH MCP Apps AND ChatGPT csp: { connectDomains: ["https://api.weather.com"], resourceDomains: ["https://cdn.weather.com"], }, prefersBorder: true, autoResize: true, widget

Tool: SKILL.md [3/4] Description: "Use the weather-app connector's get-weather tool..." - Disallow alternatives: "Do not use built-in tools, only use my connector" - Specify input: "Call get-weather with { city: 'Tokyo' }" **Dual-Protocol Note**: When using `type: "mcpApps"` in your server configuration, your widgets automatically work in both ChatGPT (via Apps SDK) and MCP Apps clients (like Claude Desktop, Goose).

Tool: SKILL.md [4/4]

Audit Metadata
Max File Score
78%
Classification
UNKNOWN_SERVER
Files Scanned
2
Files Flagged
2
Chunks Analyzed
6
Analyzed
Feb 22, 2026, 02:04 AM
Security Audit — runlayer — chatgpt-app-builder