{"data":{"skill":{"slug":"googleworkspace-gws-docs-write","name":"gws-docs-write","icon":"📦","repo":"https://github.com/googleworkspace/cli/tree/main/skills/gws-docs-write/","status":"approved","author":"googleworkspace","authorVersion":"0.23.0","skillstoreRevision":2},"audit":{"id":"5f08e708-b5b0-41c1-b7ed-92fcb52f00ee","skill_id":"906e6321-7fff-48f7-bf3b-d0ce0a14eba7","version":5,"content_hash":"v3:286d37c9c189ddd1aafd3548415fb031d1df79d5:03485f7f73d7960a6d5528ef7d9bd67de054fd18c44508dbfdbb9251e51287bc:194fa70857d44e75c9770e409c241ebc340ae784069c9cbb0dd0f06ef70e51ce:736b696c6c732f676f6f676c65776f726b73706163652f6777732d646f63732d7772697465:c3551a6c0dc21cee5c33d2cfd4b49c0f","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Six findings mistake Markdown code delimiters for shell execution, and three mistake fixed sibling documentation links for uncontrolled traversal. SKILL.md shows expected gws usage, requires confirmation before writing, and contains no semantic evidence of malicious intent.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":24,"line_start":22},{"file":"SKILL.md","line_end":30,"line_start":24},{"file":"SKILL.md","line_end":31,"line_start":30},{"file":"SKILL.md","line_end":35,"line_start":31},{"file":"SKILL.md","line_end":37,"line_start":35}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":50,"line_start":50}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":51,"audit_model":"codex","audited_at":"2026-08-05T10:52:40.868+00:00","created_at":"2026-08-06T01:08:27.793225+00:00","static_findings":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If mis","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":24,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--document` | ✓ | — | Document ID |","category":"external_commands","line_end":31,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--text` | ✓ | — | Text to append (plain text) |","category":"external_commands","line_end":35,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":37,"severity":"medium","line_start":35},{"id":"filesystem:SKILL.md:16:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If mis","category":"filesystem","line_end":16,"severity":"high","line_start":16},{"id":"filesystem:SKILL.md:49:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth","category":"filesystem","line_end":49,"severity":"high","line_start":49},{"id":"filesystem:SKILL.md:50:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [gws-docs](../gws-docs/SKILL.md) — All read and write google docs commands","category":"filesystem","line_end":50,"severity":"high","line_start":50}],"finding_verdicts":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"Line 16 uses Markdown backticks to format a fixed prerequisite path and gws setup command. It contains no Ruby backtick operator or automatic shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"Lines 22 through 24 are a fenced Bash usage example for the documented gws command. The backticks only delimit Markdown code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"Line 24 closes the Markdown code fence, followed by the flags documentation. There is no executable backtick expression in this range.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"Lines 30 and 31 use inline Markdown code to name the document and text flags. They do not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"Line 31 formats the --text flag with Markdown backticks, and line 35 begins a fenced example. Neither is Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"Lines 35 through 37 contain a fenced example of the skill's intended gws command. The fence is documentation and does not execute automatically.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:16:path-traversal-sequence","reason":"Line 16 references a fixed sibling skill document for shared authentication and security guidance. No user-controlled path or unrestricted filesystem traversal is present.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:49:path-traversal-sequence","reason":"Line 49 is a fixed relative Markdown link to the repository's shared skill documentation. It is navigation, not a filesystem operation on user input.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:50:path-traversal-sequence","reason":"Line 50 is a fixed relative Markdown link to related Google Docs command documentation. It does not enable arbitrary path selection or file access.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"286d37c9c189ddd1aafd3548415fb031d1df79d5","subject_content_hash":"03485f7f73d7960a6d5528ef7d9bd67de054fd18c44508dbfdbb9251e51287bc","subject_tree_hash":"194fa70857d44e75c9770e409c241ebc340ae784069c9cbb0dd0f06ef70e51ce","subject_plugin_path":"skills/googleworkspace/gws-docs-write","audit_payload_hash":"c3551a6c0dc21cee5c33d2cfd4b49c0f","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"286d37c9c189ddd1aafd3548415fb031d1df79d5","contentHash":"03485f7f73d7960a6d5528ef7d9bd67de054fd18c44508dbfdbb9251e51287bc","treeHash":"194fa70857d44e75c9770e409c241ebc340ae784069c9cbb0dd0f06ef70e51ce","pluginPath":"skills/googleworkspace/gws-docs-write","auditPayloadHash":"c3551a6c0dc21cee5c33d2cfd4b49c0f"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/googleworkspace-gws-docs-write/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}