{"data":{"skill":{"slug":"googleworkspace-gws-tasks","name":"gws-tasks","icon":"📦","repo":"https://github.com/googleworkspace/cli/tree/main/skills/gws-tasks/","status":"approved","author":"googleworkspace","authorVersion":"0.23.0","skillstoreRevision":2},"audit":{"id":"3ce27b86-b1d0-4b1d-81ad-93b79761373f","skill_id":"f7bae8be-7020-41d5-a5d3-bcbf167cf10d","version":5,"content_hash":"v3:286d37c9c189ddd1aafd3548415fb031d1df79d5:863b476022c562042e46022e342ab26b441356d8f44b57e1092021b8b4198923:3d8998bb02d8e88f7c98d64f0d9ddaf51ee15ddbb28f01e65183c4ba2e1d5856:736b696c6c732f676f6f676c65776f726b73706163652f6777732d7461736b73:e9ff1897fa7098c11d5cbc6411611abe","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 21 static alerts are false positives caused by Markdown backticks, code fences, and one fixed parent-directory prerequisite reference. No malicious intent or prompt injection was found.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":20,"line_start":18},{"file":"SKILL.md","line_end":26,"line_start":20},{"file":"SKILL.md","line_end":27,"line_start":26},{"file":"SKILL.md","line_end":28,"line_start":27},{"file":"SKILL.md","line_end":29,"line_start":28},{"file":"SKILL.md","line_end":30,"line_start":29},{"file":"SKILL.md","line_end":31,"line_start":30},{"file":"SKILL.md","line_end":35,"line_start":31},{"file":"SKILL.md","line_end":36,"line_start":35},{"file":"SKILL.md","line_end":37,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":37},{"file":"SKILL.md","line_end":39,"line_start":38},{"file":"SKILL.md","line_end":40,"line_start":39},{"file":"SKILL.md","line_end":41,"line_start":40},{"file":"SKILL.md","line_end":42,"line_start":41},{"file":"SKILL.md","line_end":48,"line_start":42},{"file":"SKILL.md","line_end":54,"line_start":48},{"file":"SKILL.md","line_end":56,"line_start":54},{"file":"SKILL.md","line_end":56,"line_start":56}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":58,"audit_model":"codex","audited_at":"2026-08-05T11:34:21.181+00:00","created_at":"2026-08-06T01:10:53.400814+00:00","static_findings":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If mis","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":20,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":26,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `delete` — Deletes the authenticated user's specified task list. If the list contains assigned tas","category":"external_commands","line_end":27,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `get` — Returns the authenticated user's specified task list.","category":"external_commands","line_end":28,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `insert` — Creates a new task list and adds it to the authenticated user's task lists. A user can ","category":"external_commands","line_end":29,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `list` — Returns all the authenticated user's task lists. A user can have up to 2000 lists at a ti","category":"external_commands","line_end":30,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `patch` — Updates the authenticated user's specified task list. This method supports patch semanti","category":"external_commands","line_end":31,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `update` — Updates the authenticated user's specified task list.","category":"external_commands","line_end":35,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `clear` — Clears all completed tasks from the specified task list. The affected tasks will be mark","category":"external_commands","line_end":36,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `delete` — Deletes the specified task from the task list. If the task is assigned, both the assign","category":"external_commands","line_end":37,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `get` — Returns the specified task.","category":"external_commands","line_end":38,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `insert` — Creates a new task on the specified task list. Tasks assigned from Docs or Chat Spaces ","category":"external_commands","line_end":39,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `list` — Returns all tasks in the specified task list. Doesn't return assigned tasks by default (f","category":"external_commands","line_end":40,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `move` — Moves the specified task to another position in the destination task list. If the destina","category":"external_commands","line_end":41,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `patch` — Updates the specified task. This method supports patch semantics.","category":"external_commands","line_end":42,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `update` — Updates the specified task.","category":"external_commands","line_end":48,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":54,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":56,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use `gws schema` output to build your `--params` and `--json` flags.","category":"external_commands","line_end":56,"severity":"medium","line_start":56},{"id":"filesystem:SKILL.md:16:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If mis","category":"filesystem","line_end":16,"severity":"high","line_start":16}],"finding_verdicts":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"Line 16 uses Markdown inline-code backticks around a file path and a fixed CLI command. It contains no Ruby or shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"Line 18 is the opening fence of a Bash example. The triple backticks are Markdown syntax, not executable shell substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"Line 20 is the closing Markdown fence for a command usage example. It does not execute any content.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"Line 26 wraps the task-list method name delete in Markdown inline code. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"Line 27 wraps the task-list method name get in Markdown inline code. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"Line 28 wraps the task-list method name insert in Markdown inline code. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"Line 29 wraps the task-list method name list in Markdown inline code. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"Line 30 wraps the task-list method name patch in Markdown inline code. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"Line 31 wraps the task-list method name update in Markdown inline code. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"Line 35 wraps the task method name clear in Markdown inline code. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"Line 36 wraps the task method name delete in Markdown inline code. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"Line 37 wraps the task method name get in Markdown inline code. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"Line 38 wraps the task method name insert in Markdown inline code. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"Line 39 wraps the task method name list in Markdown inline code. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"Line 40 wraps the task method name move in Markdown inline code. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"Line 41 wraps the task method name patch in Markdown inline code. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"Line 42 wraps the task method name update in Markdown inline code. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"Line 48 is the opening fence for documented Bash commands. The triple backticks are Markdown syntax, not command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"Line 54 is the closing Markdown fence for documented CLI examples. It does not execute any content.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"Line 56 uses Markdown inline code to name CLI commands and flags. It contains no shell or Ruby execution construct.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:16:path-traversal-sequence","reason":"Line 16 references a fixed sibling skill file through one parent directory. No user-controlled path or unrestricted filesystem traversal exists.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[],"subject_marketplace_commit_sha":"286d37c9c189ddd1aafd3548415fb031d1df79d5","subject_content_hash":"863b476022c562042e46022e342ab26b441356d8f44b57e1092021b8b4198923","subject_tree_hash":"3d8998bb02d8e88f7c98d64f0d9ddaf51ee15ddbb28f01e65183c4ba2e1d5856","subject_plugin_path":"skills/googleworkspace/gws-tasks","audit_payload_hash":"e9ff1897fa7098c11d5cbc6411611abe","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"286d37c9c189ddd1aafd3548415fb031d1df79d5","contentHash":"863b476022c562042e46022e342ab26b441356d8f44b57e1092021b8b4198923","treeHash":"3d8998bb02d8e88f7c98d64f0d9ddaf51ee15ddbb28f01e65183c4ba2e1d5856","pluginPath":"skills/googleworkspace/gws-tasks","auditPayloadHash":"e9ff1897fa7098c11d5cbc6411611abe"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/googleworkspace-gws-tasks/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}