{"data":{"skill":{"slug":"googleworkspace-gws-forms","name":"gws-forms","icon":"📦","repo":"https://github.com/googleworkspace/cli/tree/main/skills/gws-forms/","status":"approved","author":"googleworkspace","authorVersion":"0.23.0","skillstoreRevision":2},"audit":{"id":"589bec3e-761b-4c09-aa17-5f6c351f5146","skill_id":"dd832081-4146-4069-8779-3d02ce4e9992","version":5,"content_hash":"v3:286d37c9c189ddd1aafd3548415fb031d1df79d5:f538eba53ebad0b5e1c46b0b0082a214a7899a08dd04be1dcedcf560608c1fa9:79f8dc81b863685a314149a54d52f5f22b65302527723bf1414ec506aad00ed9:736b696c6c732f676f6f676c65776f726b73706163652f6777732d666f726d73:fecfcb414d8f148890d112d8d9b1ddf9","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 12 external-command alerts are false positives caused by Markdown backticks and fenced CLI examples, not executable Ruby or shell substitution. The path reference is fixed documentation for a sibling skill, with no user-controlled traversal or malicious intent.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":20,"line_start":18},{"file":"SKILL.md","line_end":26,"line_start":20},{"file":"SKILL.md","line_end":27,"line_start":26},{"file":"SKILL.md","line_end":28,"line_start":27},{"file":"SKILL.md","line_end":29,"line_start":28},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":31,"line_start":30},{"file":"SKILL.md","line_end":37,"line_start":31},{"file":"SKILL.md","line_end":43,"line_start":37},{"file":"SKILL.md","line_end":45,"line_start":43},{"file":"SKILL.md","line_end":45,"line_start":45}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":47,"audit_model":"codex","audited_at":"2026-08-05T11:00:52.177+00:00","created_at":"2026-08-06T01:08:55.201894+00:00","static_findings":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If mis","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":20,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":26,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `batchUpdate` — Change the form with a batch of updates.","category":"external_commands","line_end":27,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `create` — Create a new form using the title given in the provided form message in the request. *I","category":"external_commands","line_end":28,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `get` — Get a form.","category":"external_commands","line_end":29,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `setPublishSettings` — Updates the publish settings of a form. Legacy forms aren't supported becau","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `responses` — Operations on the 'responses' resource","category":"external_commands","line_end":31,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `watches` — Operations on the 'watches' resource","category":"external_commands","line_end":37,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":43,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":45,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use `gws schema` output to build your `--params` and `--json` flags.","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"filesystem:SKILL.md:16:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If mis","category":"filesystem","line_end":16,"severity":"high","line_start":16}],"finding_verdicts":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"Line 16 uses Markdown backticks to format a fixed file path and CLI command; it contains no Ruby expression or shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"Line 18 is the opening marker of a fenced Bash example, so the backticks are Markdown syntax rather than command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"Line 20 closes the fenced CLI usage example and does not execute its contents.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"Line 26 formats the batchUpdate method name as inline Markdown and contains no executable expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"Line 27 formats the create method name as inline Markdown while describing documented API behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"Line 28 uses backticks only to format the get method name in a documentation list.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"Line 29 uses inline Markdown for setPublishSettings and publish_settings, with no shell or Ruby evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"Line 30 formats the responses resource name as documentation and does not invoke an external process.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"Line 31 formats the watches resource name as documentation and contains no executable code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"Line 37 opens a fenced Bash documentation block; the backticks do not perform shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"Line 43 closes a fenced block containing ordinary gws help and schema examples.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"Line 45 uses inline Markdown to name the gws schema command and its flags, without dynamic execution.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:16:path-traversal-sequence","reason":"Line 16 references one fixed sibling skill file for shared authentication guidance; no user-controlled path or arbitrary traversal is present.","verdict":"false_positive","confidence":0.96}],"semantic_findings":[],"subject_marketplace_commit_sha":"286d37c9c189ddd1aafd3548415fb031d1df79d5","subject_content_hash":"f538eba53ebad0b5e1c46b0b0082a214a7899a08dd04be1dcedcf560608c1fa9","subject_tree_hash":"79f8dc81b863685a314149a54d52f5f22b65302527723bf1414ec506aad00ed9","subject_plugin_path":"skills/googleworkspace/gws-forms","audit_payload_hash":"fecfcb414d8f148890d112d8d9b1ddf9","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"286d37c9c189ddd1aafd3548415fb031d1df79d5","contentHash":"f538eba53ebad0b5e1c46b0b0082a214a7899a08dd04be1dcedcf560608c1fa9","treeHash":"79f8dc81b863685a314149a54d52f5f22b65302527723bf1414ec506aad00ed9","pluginPath":"skills/googleworkspace/gws-forms","auditPayloadHash":"fecfcb414d8f148890d112d8d9b1ddf9"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/googleworkspace-gws-forms/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}