TL;DR
An inventory of one agent session’s 232 tools and 44 skills is publicly readable. As well as showing what the tools do, the category names show which integrations that session had been given, including several personal data sources. If you run a personal agent stack, generating your own manifest is worth doing and sending it anywhere is a separate decision. I could not confirm who published it or why, and the page does not show whether any given connection still held working credentials.
In plain English
A tool is a single callable action an agent can take: send an email, read a row, open a file. A skill is a written instruction file telling the agent how and when to use those tools for a particular job. Together they are the agent’s manifest, the answer to “what can this thing actually do.” It is not a document you normally see, because it gets assembled at runtime out of whatever apps and connectors have been added over the months. Any agent can be asked to write the whole thing down in one go.
A tool and skill inventory belonging to a ChatGPT Work session appeared at a public URL on 31 August. Two hundred and thirty-two tool interfaces. Forty-four skill files, which the page says it reproduces verbatim and measures at 615,000 characters of source. The reference site is well made and easy to read, and it sits on chatgpt.site, OpenAI’s own publishing domain for pages produced inside a session. The page describes itself as “a complete snapshot of the callable interfaces and reusable workflow definitions available to this Work session.”
I read it as a useful reference at first. Then I started reading the category names instead of the tool names.
The page groups its 232 tools into twenty-four categories. GitHub, eighty-nine. Gmail, twenty-one. Sites, twenty-three. Google Calendar, fifteen. Zillow, nine. Google Contacts, three. Then a run of categories that are not products at all: a personal blog’s database, a fitness database, a pets category with eleven tools in it, one called “Personal context,” and two more headed “Safety & family” and “Safety & support.”
By the time you reach the pets, the list is not describing what a model is good at any more. It is describing a particular setup. Somebody added each of those integrations, and the list shows what the session could do inside each one, down to the individual call.
I want to be precise about what that does and does not establish, because it is easy to overstate. I have no way to check the snapshot is complete, and for this argument it does not need to be. A manifest lists interfaces that were exposed to the session. It does not show whether a given connection still held working credentials at the moment the page was made, and an interface can sit there installed and dead. What the list gives you is the shape of the setup: which services were wired in, and what the agent was equipped to do with each. That falls short of proving any account was live. It is still a description of where one person keeps their email, their code, their calendar, their contacts and their family arrangements.
My first thought was about my own work. When I started building Cerebro I was keen to describe what tooling it had, partly to understand it and partly because it was interesting. The more I look at this page, and at how personal agentic systems are becoming, the more that instinct looks like another example of exfiltration.
I want to be careful with that word. Exfiltration usually means data leaving against the owner’s wishes, and I have no evidence that happened here. The page looks deliberate, and whoever made it may have understood every line of what they were posting. What carries over is the process. An agent was asked to describe itself, it listed what it had been wired into, and that list was published. Whether it was published on purpose is a different question from what happens when someone who is not sure what they have connected makes the same request.
Since April I have been telling readers to ask their AI what it can already do. I still think that is right, and this page is not an example of it.
When I say ask your AI what it can do, I mean a dialogue that helps you and the agent define a working toolset between you, aimed at something you are actually trying to get done. I do not mean print out a list of all your capabilities and access planes and show it to the whole wide world. The April piece was about a conversation with a purpose: find out what you already have, decide together what you actually need, stop paying for the rest. One of those stays between you and the assistant. The other one is on the internet for anyone to read. The request that produces them is worded almost identically, and I have not resolved that.
Kept internal, the inventory answers a question that is awkward to answer any other way, and that is what I use it for: preventing drift.
Drift is the difference between what you think your agent can reach and what it can actually reach. You connect a service for one job, never revoke it, and months later the assistant still has working access to something you have stopped thinking about. A periodic manifest catches that, and I have not found much else that does, because you will not review a connection you no longer remember making. Four days ago I wrote about what a compressed instruction like “ship it” actually carries. That piece was about what a short instruction assumes. This one is about what the agent can reach.
The page sits on the subdomain simonw.chatgpt.site, and its tool categories include a database belonging to Simon Willison’s blog. That points at one person, but it does not prove anything. He has not claimed the page publicly, his blog carried no post about it as of 31 August, and the Hacker News submission came from a different account. I could not confirm who published it, so I am not naming anyone. The same thing would happen whoever’s session it was, and naming someone would add nothing, while I could be wrong about a real person.
Generate your own. Read the categories first; the individual tools are the part you already expect. The categories are the list of what that session could reach.
Then think about where the file goes, because the obvious next move is to paste it into a chat window and ask what it all means.