{"data":{"skill":{"slug":"googleworkspace-gws-docs","name":"gws-docs","icon":"📦","repo":"https://github.com/googleworkspace/cli/tree/main/skills/gws-docs/","status":"approved","author":"googleworkspace","authorVersion":"0.23.0","skillstoreRevision":2},"audit":{"id":"d377d6b8-9176-4bc9-a019-a2c0cf03e3e4","skill_id":"6493071a-2f79-4542-86fa-b713964930dc","version":7,"content_hash":"v3:286d37c9c189ddd1aafd3548415fb031d1df79d5:65c96b30a142b214d3408e069da89911717f9d3ca087783b1b3a851c93294781:a958f7d7d07818a15199ee35d80f96168beb67bc17fb87ffb0efcd26b22ed65e:736b696c6c732f676f6f676c65776f726b73706163652f6777732d646f6373:368fab76363a96d0d4aee370bfa640f3","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 13 static findings are false positives caused by Markdown backticks, code fences, API prose, or fixed sibling-file references. The skill documents expected gws CLI usage and contains no dynamic command execution, network implementation, path traversal input, or prompt injection.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":20,"line_start":18},{"file":"SKILL.md","line_end":26,"line_start":20},{"file":"SKILL.md","line_end":32,"line_start":26},{"file":"SKILL.md","line_end":33,"line_start":32},{"file":"SKILL.md","line_end":34,"line_start":33},{"file":"SKILL.md","line_end":40,"line_start":34},{"file":"SKILL.md","line_end":46,"line_start":40},{"file":"SKILL.md","line_end":48,"line_start":46},{"file":"SKILL.md","line_end":48,"line_start":48}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":32,"line_start":32}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":26,"line_start":26}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":50,"audit_model":"codex","audited_at":"2026-08-05T10:49:47.446+00:00","created_at":"2026-08-06T01:08:18.66217+00:00","static_findings":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If mis","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":20,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":26,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| [`+write`](../gws-docs-write/SKILL.md) | Append text to a document |","category":"external_commands","line_end":32,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `batchUpdate` — Applies one or more updates to the document. Each request is validated before bein","category":"external_commands","line_end":33,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `create` — Creates a blank document using the title given in the request. Other fields in the requ","category":"external_commands","line_end":34,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `get` — Gets the latest version of the specified document.","category":"external_commands","line_end":40,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":46,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":48,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use `gws schema` output to build your `--params` and `--json` flags.","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"network:SKILL.md:32:python-http-libraries","file":"SKILL.md","pattern":"Python HTTP libraries","snippet":"- `batchUpdate` — Applies one or more updates to the document. Each request is validated before bein","category":"network","line_end":32,"severity":"low","line_start":32},{"id":"filesystem:SKILL.md:16:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If mis","category":"filesystem","line_end":16,"severity":"high","line_start":16},{"id":"filesystem:SKILL.md:26:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"| [`+write`](../gws-docs-write/SKILL.md) | Append text to a document |","category":"filesystem","line_end":26,"severity":"high","line_start":26}],"finding_verdicts":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"Line 16 uses Markdown backticks to name a fixed gws command and a prerequisite file. It does not contain Ruby execution or interpolate untrusted command input.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"Line 18 is the opening marker for a Bash example block. A Markdown code fence does not execute a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"Line 20 closes the Bash example block. It contains no executable Ruby or shell expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"Line 26 is a Markdown table link whose label is formatted as inline code. It documents a helper skill and performs no command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"Line 32 formats the batchUpdate API method name with Markdown backticks. The surrounding text is API documentation, not an execution construct.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"Line 33 formats the create API method name with Markdown backticks. No shell or Ruby execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"Line 34 formats the get API method name with Markdown backticks. It is descriptive prose without an execution path.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"Line 40 opens a Bash example block containing documented gws discovery commands. The fence itself is not executable code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"Line 46 closes the Bash example block. It has no command or dynamic execution behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"Line 48 uses Markdown backticks around fixed command and flag names. It contains no shell substitution or untrusted command construction.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:32:python-http-libraries","reason":"Line 32 describes Google Docs batchUpdate requests in prose. It imports no Python HTTP library and implements no network request.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:16:path-traversal-sequence","reason":"Line 16 references a fixed sibling skill path within the generated skill bundle. The path is not user-controlled and is not used for arbitrary filesystem access.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:26:path-traversal-sequence","reason":"Line 26 contains a fixed relative Markdown link to the adjacent writing helper. It does not accept input or enable traversal to arbitrary paths.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[],"subject_marketplace_commit_sha":"286d37c9c189ddd1aafd3548415fb031d1df79d5","subject_content_hash":"65c96b30a142b214d3408e069da89911717f9d3ca087783b1b3a851c93294781","subject_tree_hash":"a958f7d7d07818a15199ee35d80f96168beb67bc17fb87ffb0efcd26b22ed65e","subject_plugin_path":"skills/googleworkspace/gws-docs","audit_payload_hash":"368fab76363a96d0d4aee370bfa640f3","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"286d37c9c189ddd1aafd3548415fb031d1df79d5","contentHash":"65c96b30a142b214d3408e069da89911717f9d3ca087783b1b3a851c93294781","treeHash":"a958f7d7d07818a15199ee35d80f96168beb67bc17fb87ffb0efcd26b22ed65e","pluginPath":"skills/googleworkspace/gws-docs","auditPayloadHash":"368fab76363a96d0d4aee370bfa640f3"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/googleworkspace-gws-docs/audits/7/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}