Feature request: allow controlled network access for ChatGPT Skills

ChatGPT Feature requests
1

ChatGPT Skills should optionally support outbound HTTP requests from their execution environment, using an explicit and reviewable permission model.

A Skill could declare:

  • whether network access is required;
  • an allowlist of permitted domains;
  • the secrets or OAuth scopes it needs;
  • whether each request requires user confirmation;
  • workspace-level administrator approval and audit logs.

For example:

permissions:
  network:
    allowed_domains:
      - api.example.com
      - auth.example.com
  secrets:
    - EXAMPLE_API_KEY
  user_confirmation: write_operations

This would make Skills capable of implementing complete, portable workflows without requiring developers to create and host a separate MCP app for every simple API integration.

ChatGPT already supports external API calls through GPT Actions, while Skills can use networking in some other OpenAI execution environments. Extending the same controlled-domain approach to Skills inside ChatGPT would therefore simplify the developer experience without requiring unrestricted internet access.

The expected safeguards could include domain allowlists, redirect restrictions, secret isolation, rate limits, explicit installation permissions, user approval for sensitive actions, and administrator controls.

This would also make ChatGPT Skills more competitive with skill systems that already allow sandboxed network access restricted to approved domains.