{"data":{"skill":{"slug":"googleworkspace-gws-calendar-agenda","name":"gws-calendar-agenda","icon":"📦","repo":"https://github.com/googleworkspace/cli/tree/main/skills/gws-calendar-agenda/","status":"approved","author":"googleworkspace","authorVersion":"0.23.0","skillstoreRevision":2},"audit":{"id":"f55bde8e-4dd8-4dc2-af96-33f2bd1b9ba1","skill_id":"646242b3-54cf-46f8-8273-f2066d142f72","version":5,"content_hash":"v3:286d37c9c189ddd1aafd3548415fb031d1df79d5:515bdec6c2427831541d59d4e56b916d5f28cbe6de91f116ec0d2c8eb24a6c7b:8aee07c25a8ad8d72ec2b2498d3be45a548087a2779538cf795a87d719dd7e07:736b696c6c732f676f6f676c65776f726b73706163652f6777732d63616c656e6461722d6167656e6461:43cdf290cdba49fd99aecbeceb9b2830","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 13 static findings are false positives caused by Markdown backticks, code fences, and relative documentation links. The skill documents read-only Google Calendar commands and shows no prompt injection, unsafe path handling, or malicious intent.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":24,"line_start":22},{"file":"SKILL.md","line_end":30,"line_start":24},{"file":"SKILL.md","line_end":31,"line_start":30},{"file":"SKILL.md","line_end":32,"line_start":31},{"file":"SKILL.md","line_end":33,"line_start":32},{"file":"SKILL.md","line_end":34,"line_start":33},{"file":"SKILL.md","line_end":35,"line_start":34},{"file":"SKILL.md","line_end":39,"line_start":35},{"file":"SKILL.md","line_end":45,"line_start":39}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":55,"line_start":55},{"file":"SKILL.md","line_end":56,"line_start":56}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":57,"audit_model":"codex","audited_at":"2026-08-05T10:45:23.79+00:00","created_at":"2026-08-06T01:08:00.489247+00:00","static_findings":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If mis","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":24,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--today` | — | — | Show today's events |","category":"external_commands","line_end":31,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--tomorrow` | — | — | Show tomorrow's events |","category":"external_commands","line_end":32,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--week` | — | — | Show this week's events |","category":"external_commands","line_end":33,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--days` | — | — | Number of days ahead to show |","category":"external_commands","line_end":34,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--calendar` | — | — | Filter to specific calendar name or ID |","category":"external_commands","line_end":35,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--timezone` | — | — | IANA timezone override (e.g. America/Denver). Defaults to Google account ti","category":"external_commands","line_end":39,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":45,"severity":"medium","line_start":39},{"id":"filesystem:SKILL.md:16:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If mis","category":"filesystem","line_end":16,"severity":"high","line_start":16},{"id":"filesystem:SKILL.md:55:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth","category":"filesystem","line_end":55,"severity":"high","line_start":55},{"id":"filesystem:SKILL.md:56:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [gws-calendar](../gws-calendar/SKILL.md) — All manage calendars and events commands","category":"filesystem","line_end":56,"severity":"high","line_start":56}],"finding_verdicts":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown code for a relative documentation path and a fixed gws command. They are not Ruby execution syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"This line is a Markdown bash fence introducing a documented CLI example. It does not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"This line closes a Markdown code fence after a fixed agenda command. It contains no Ruby backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The backticks format the literal --today flag in a Markdown table. No command is evaluated.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The backticks format the literal --tomorrow flag in a Markdown table. No command is evaluated.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The backticks format the literal --week flag in a Markdown table. No command is evaluated.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The backticks format the literal --days flag in a Markdown table. No command is evaluated.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The backticks format the literal --calendar flag in a Markdown table. No command is evaluated.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The backticks format the literal --timezone flag in a Markdown table. No command is evaluated.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"This line is a Markdown bash fence for fixed gws usage examples. It is documentation, not executable Ruby syntax.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:16:path-traversal-sequence","reason":"The parent segment references a known sibling skill document. It is a fixed documentation path, not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:55:path-traversal-sequence","reason":"This is a fixed relative Markdown link to the sibling gws-shared documentation. It performs no filesystem operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:56:path-traversal-sequence","reason":"This is a fixed relative Markdown link to the sibling gws-calendar documentation. It performs no filesystem operation.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"286d37c9c189ddd1aafd3548415fb031d1df79d5","subject_content_hash":"515bdec6c2427831541d59d4e56b916d5f28cbe6de91f116ec0d2c8eb24a6c7b","subject_tree_hash":"8aee07c25a8ad8d72ec2b2498d3be45a548087a2779538cf795a87d719dd7e07","subject_plugin_path":"skills/googleworkspace/gws-calendar-agenda","audit_payload_hash":"43cdf290cdba49fd99aecbeceb9b2830","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"286d37c9c189ddd1aafd3548415fb031d1df79d5","contentHash":"515bdec6c2427831541d59d4e56b916d5f28cbe6de91f116ec0d2c8eb24a6c7b","treeHash":"8aee07c25a8ad8d72ec2b2498d3be45a548087a2779538cf795a87d719dd7e07","pluginPath":"skills/googleworkspace/gws-calendar-agenda","auditPayloadHash":"43cdf290cdba49fd99aecbeceb9b2830"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/googleworkspace-gws-calendar-agenda/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}