{"data":{"skill":{"slug":"googleworkspace-gws-calendar-agenda","name":"gws-calendar-agenda","icon":"📦","repo":"https://github.com/googleworkspace/cli/tree/main/skills/gws-calendar-agenda/","status":"approved","author":"googleworkspace","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"d9c09301-6b7e-4335-841a-643f7a2eb19c","skill_id":"646242b3-54cf-46f8-8273-f2066d142f72","version":3,"content_hash":"v2:a06681402992ceae98ba04d54cfd4ab004862696:b05529fb72948d1a136afb7728c211f63086c98bf9578570c4d5d53c7b12b9a6:a283588342f19d48f9bfeba2fa15e85445aeada6ae564eb926bc5a0bb9939efa:86225cc3d8092519a76090d131fb09c2","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The static command findings are false positives from Markdown code fences, inline flag names, and static gws CLI examples. The filesystem findings are hardcoded sibling documentation links, not arbitrary path traversal or access to sensitive files. No prompt injection, data exfiltration intent, or unsafe business logic was found in SKILL.md.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":24,"line_start":22},{"file":"SKILL.md","line_end":30,"line_start":24},{"file":"SKILL.md","line_end":31,"line_start":30},{"file":"SKILL.md","line_end":32,"line_start":31},{"file":"SKILL.md","line_end":33,"line_start":32},{"file":"SKILL.md","line_end":34,"line_start":33},{"file":"SKILL.md","line_end":35,"line_start":34},{"file":"SKILL.md","line_end":39,"line_start":35},{"file":"SKILL.md","line_end":45,"line_start":39}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":55,"line_start":55},{"file":"SKILL.md","line_end":56,"line_start":56}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":57,"audit_model":"codex","audited_at":"2026-07-06T15:56:16.439+00:00","created_at":"2026-07-06T17:32:27.679998+00:00","static_findings":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If mis","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":24,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--today` | — | — | Show today's events |","category":"external_commands","line_end":31,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--tomorrow` | — | — | Show tomorrow's events |","category":"external_commands","line_end":32,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--week` | — | — | Show this week's events |","category":"external_commands","line_end":33,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--days` | — | — | Number of days ahead to show |","category":"external_commands","line_end":34,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--calendar` | — | — | Filter to specific calendar name or ID |","category":"external_commands","line_end":35,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--timezone` | — | — | IANA timezone override (e.g. America/Denver). Defaults to Google account ti","category":"external_commands","line_end":39,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":45,"severity":"medium","line_start":39},{"id":"filesystem:SKILL.md:16:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If mis","category":"filesystem","line_end":16,"severity":"high","line_start":16},{"id":"filesystem:SKILL.md:55:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth","category":"filesystem","line_end":55,"severity":"high","line_start":55},{"id":"filesystem:SKILL.md:56:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [gws-calendar](../gws-calendar/SKILL.md) — All manage calendars and events commands","category":"filesystem","line_end":56,"severity":"high","line_start":56}],"finding_verdicts":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"Line 16 uses Markdown inline code for documentation references and a gws command name. It is not Ruby backtick execution and does not interpolate user input.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"Line 22 starts a Markdown bash code fence. A fence marker is not executable code and has no command injection behavior.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"This region contains the end of a Markdown code fence and nearby prose. It does not contain Ruby shell backtick execution or dynamic command construction.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"Line 30 documents the --today flag inside Markdown inline code. It is a static flag name, not executable shell syntax.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"Line 31 documents the --tomorrow flag inside a Markdown table. The backticks are formatting only and do not run commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"Line 32 documents the --week flag inside Markdown inline code. No executable command or user-controlled shell input is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"Line 33 documents the --days flag in a table. The content is static documentation, not Ruby or shell execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"Line 34 documents the --calendar flag in Markdown. It does not construct or execute a command from untrusted input.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"Line 35 documents the --timezone flag in a Markdown table. The backticks are formatting and are not shell execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"Line 39 starts a Markdown bash example block with static gws calendar commands. These examples use fixed command names and flags, not dynamic execution or injection-prone interpolation.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:SKILL.md:16:path-traversal-sequence","reason":"Line 16 links to a hardcoded sibling skill document for shared authentication guidance. It is not a user-controlled path and does not target sensitive filesystem locations.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:55:path-traversal-sequence","reason":"Line 55 is a Markdown see-also link to the shared Google Workspace skill documentation. The path is static documentation, not arbitrary traversal logic.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:SKILL.md:56:path-traversal-sequence","reason":"Line 56 is a Markdown see-also link to related calendar documentation. The relative path is fixed and does not expose or read sensitive files.","verdict":"false_positive","confidence":0.88}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}