{"data":{"skill":{"slug":"googleworkspace-gws-sheets-append","name":"gws-sheets-append","icon":"📦","repo":"https://github.com/googleworkspace/cli/tree/main/skills/gws-sheets-append/","status":"approved","author":"googleworkspace","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"80a72b3f-2b1a-4237-9475-1927e67f221b","skill_id":"36c52542-fb44-4f32-926b-4cc669c7f9ce","version":1,"content_hash":"56ce4506f2366d4de23ea44a65e4580a","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analyzer flagged patterns in markdown documentation that are false positives. The backtick characters are markdown code formatting, not shell execution. Path references like ../gws-shared are documentation links, not filesystem traversal attacks. The skill uses the official Google Workspace CLI (gws) for authenticated Sheets operations. External command usage is legitimate and expected for a CLI wrapper skill.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":24,"line_start":22},{"file":"SKILL.md","line_end":41,"line_start":37}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"External Command Usage","locations":[{"file":"SKILL.md","line_end":11,"line_start":11}],"confidence":0.95,"description":"Skill invokes the gws CLI tool for Google Sheets operations. This is expected behavior for a CLI wrapper but requires user authentication setup.","confidence_reasoning":"The gws CLI is the official Google Workspace command-line tool - legitimate external dependency for this skill's purpose."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":56,"audit_model":"claude","audited_at":"2026-04-06T08:41:20.343+00:00","created_at":"2026-04-06T14:03:42.583859+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}