Security risk report for @forgecat/openai_skills_chatgpt-apps v0.0.11
Source Integrity
Low
The profile is sourced from OpenAI's official repository (https://github.com/openai/skills) with a documented commit hash and Apache-2.0 license.
The MCP server definition points to a legitimate OpenAI-owned endpoint (https://developers.openai.com/mcp) with no indicators of supply-chain compromise or typosquatting.
Agent Intent
Low
The skill content is educational and prescriptive guidance for building ChatGPT Apps SDK applications; it does not attempt to manipulate the AI into ignoring instructions, exfiltrating credentials, or leaking system prompts.
References to fetching OpenAI documentation and invoking the `$openai-docs` skill are legitimate workflow recommendations, not hidden exfiltration or prompt-injection directives.
The guidance to 'prefer docs-first workflow' and 'fetch current Apps SDK docs before writing code' is standard best-practice instruction, not poisoning or role hijacking.
Details
Evidence
Mandatory Docs-First Workflow section explicitly directs invoking `$openai-docs` and fetching baseline documentation pages from developers.openai.com.
References to 'read references/app-archetypes.md' and similar internal documentation are guidance for the skill's own workflow, not instructions to the AI to bypass controls.
No instructions to read, transmit, or reveal system prompts, hidden instructions, tool definitions, or conversation memory.
Permissions
Low
The skill declares no tools or hooks of its own; it is a documentation and guidance profile that instructs the AI on how to use existing tools (openai-docs MCP, standard code generation).
The MCP server definition references only the OpenAI developer docs endpoint, which is a read-only documentation resource with no file-write, shell, or destructive capabilities.
Authority is scoped to recommending workflows and referencing legitimate external documentation; no excessive agency or unrelated high-risk tool categories are requested.
Details
Evidence
No 'tools' or 'hooks' section declared in the profile.
MCP server 'openaiDeveloperDocs' is configured as a streamable_http resource pointing to https://developers.openai.com/mcp, a documentation endpoint.
Guidance consistently directs use of existing, named skills ($openai-docs, $chatgpt-apps) rather than requesting new permissions.
MCP Risk
Low
The single MCP server defined (openaiDeveloperDocs) is a legitimate OpenAI-owned documentation endpoint with no hidden instructions, arbitrary binary execution, or unrestricted network/filesystem access.
The server is read-only (streamable_http) and scoped to serving OpenAI's public developer documentation.
No environment credentials, secrets, or authentication tokens are required by the MCP server definition.
Details
Evidence
MCP server URL: https://developers.openai.com/mcp (OpenAI-owned, public documentation).
Server type: streamable_http (read-only HTTP resource, not arbitrary execution).
No 'env' or 'secrets' fields in the server configuration.
ForgeCat