{"data":{"skill":{"slug":"googleworkspace-gws-sheets-append","name":"gws-sheets-append","icon":"📦","repo":"https://github.com/googleworkspace/cli/tree/main/skills/gws-sheets-append/","status":"approved","author":"googleworkspace","authorVersion":"0.23.0","skillstoreRevision":2},"audit":{"id":"728650bc-a0de-44b0-9a0b-9f4c9473ff4f","skill_id":"36c52542-fb44-4f32-926b-4cc669c7f9ce","version":7,"content_hash":"v3:286d37c9c189ddd1aafd3548415fb031d1df79d5:abeb17f795be9663a3eda75f8c141e5b91ca6a468ccb554be79e83b90d0d7d6b:7176093a30b081eda3935490f79ce2b92d0ee561a80a4f2013da5c6bb6004d11:736b696c6c732f676f6f676c65776f726b73706163652f6777732d7368656574732d617070656e64:6009bafe37b3ecc6309955790abf79ae","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All static findings are false positives caused by Markdown code formatting or fixed links to sibling skill documentation. No prompt injection, data exfiltration intent, or unsafe user-controlled path handling was found.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":24,"line_start":22},{"file":"SKILL.md","line_end":30,"line_start":24},{"file":"SKILL.md","line_end":31,"line_start":30},{"file":"SKILL.md","line_end":32,"line_start":31},{"file":"SKILL.md","line_end":33,"line_start":32},{"file":"SKILL.md","line_end":37,"line_start":33},{"file":"SKILL.md","line_end":41,"line_start":37}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":54,"line_start":54},{"file":"SKILL.md","line_end":55,"line_start":55}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":56,"audit_model":"codex","audited_at":"2026-08-05T11:26:40.17+00:00","created_at":"2026-08-06T01:10:26.065999+00:00","static_findings":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If mis","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":24,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--spreadsheet` | ✓ | — | Spreadsheet ID |","category":"external_commands","line_end":31,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--values` | — | — | Comma-separated values (simple strings) |","category":"external_commands","line_end":32,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--json-values` | — | — | JSON array of rows, e.g. '[[\"a\",\"b\"],[\"c\",\"d\"]]' |","category":"external_commands","line_end":33,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--range` | — | — | Target range in A1 notation (e.g. 'Sheet2!A1'). Defaults to 'A1' (first sheet)","category":"external_commands","line_end":37,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":41,"severity":"medium","line_start":37},{"id":"filesystem:SKILL.md:16:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If mis","category":"filesystem","line_end":16,"severity":"high","line_start":16},{"id":"filesystem:SKILL.md:54:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth","category":"filesystem","line_end":54,"severity":"high","line_start":54},{"id":"filesystem:SKILL.md:55:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [gws-sheets](../gws-sheets/SKILL.md) — All read and write spreadsheets commands","category":"filesystem","line_end":55,"severity":"high","line_start":55}],"finding_verdicts":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"Line 16 uses Markdown backticks around a prerequisite path and a documented gws command. It contains no Ruby execution or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"Line 22 starts a fenced Bash example. The backticks are Markdown delimiters, not an executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"Line 24 closes a fenced Bash example. It does not invoke Ruby, a shell, or dynamic command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"Line 30 formats the --spreadsheet flag as inline Markdown code. No command execution construct is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"Line 31 formats the --values flag as inline Markdown code. The backticks are documentation syntax only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"Line 32 formats the --json-values flag as inline Markdown code. It contains no executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"Line 33 formats the --range flag as inline Markdown code. No shell command substitution or dynamic execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"Line 37 starts a fenced Bash examples block. The backticks only identify the Markdown code block.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:16:path-traversal-sequence","reason":"Line 16 references a fixed sibling skill file required for shared guidance. The path is not derived from user input and does not enable arbitrary traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:54:path-traversal-sequence","reason":"Line 54 is a fixed relative Markdown link to sibling documentation. It performs no filesystem operation and accepts no user-controlled path.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:55:path-traversal-sequence","reason":"Line 55 is a fixed relative Markdown link to sibling documentation. It is navigation metadata, not runtime path handling.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"286d37c9c189ddd1aafd3548415fb031d1df79d5","subject_content_hash":"abeb17f795be9663a3eda75f8c141e5b91ca6a468ccb554be79e83b90d0d7d6b","subject_tree_hash":"7176093a30b081eda3935490f79ce2b92d0ee561a80a4f2013da5c6bb6004d11","subject_plugin_path":"skills/googleworkspace/gws-sheets-append","audit_payload_hash":"6009bafe37b3ecc6309955790abf79ae","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"286d37c9c189ddd1aafd3548415fb031d1df79d5","contentHash":"abeb17f795be9663a3eda75f8c141e5b91ca6a468ccb554be79e83b90d0d7d6b","treeHash":"7176093a30b081eda3935490f79ce2b92d0ee561a80a4f2013da5c6bb6004d11","pluginPath":"skills/googleworkspace/gws-sheets-append","auditPayloadHash":"6009bafe37b3ecc6309955790abf79ae"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/googleworkspace-gws-sheets-append/audits/7/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}