{"data":{"skill":{"slug":"sickn33-google-calendar-automation","name":"google-calendar-automation","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/google-calendar-automation","status":"approved","author":"sickn33","authorVersion":"1.0","skillstoreRevision":2},"audit":{"id":"90aefb34-5deb-4e58-8d89-7c7ba1b944cf","skill_id":"f0802823-5643-47c3-a000-665c1c75ca09","version":5,"content_hash":"v3:88a8e9a07f4c54ab105c1c41b6267c287146b07b:8999e70f4ebee6cacdc19d5dab649efd61d7c20817da14b22a946bc902b4abf8:495a09e716b569c0e2c3241b3e8735bd5c1b7b15899ac8982c6f488514f1cd2a:736b696c6c732f7369636b6e33332f676f6f676c652d63616c656e6461722d6175746f6d6174696f6e:a15e21dbe32eba33ca35e603bb8e75df","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 27 static findings are false positives caused by Markdown fences or inline literals; SKILL.md contains no Ruby or shell backtick execution. However, the document directs users to missing Python scripts that would handle OAuth credentials and calendar changes, so the security-sensitive implementation cannot be audited.","remediation":[{"issue":"The referenced authentication and calendar scripts are absent from the package.","severity":"medium","suggestion":"Bundle the reviewed scripts and dependencies, then document OAuth scopes, network endpoints, token storage, and token refresh behavior."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":28,"line_start":26},{"file":"SKILL.md","line_end":31,"line_start":28},{"file":"SKILL.md","line_end":33,"line_start":31},{"file":"SKILL.md","line_end":36,"line_start":33},{"file":"SKILL.md","line_end":38,"line_start":36},{"file":"SKILL.md","line_end":42,"line_start":38},{"file":"SKILL.md","line_end":45,"line_start":42},{"file":"SKILL.md","line_end":47,"line_start":45},{"file":"SKILL.md","line_end":50,"line_start":47},{"file":"SKILL.md","line_end":62,"line_start":50},{"file":"SKILL.md","line_end":65,"line_start":62},{"file":"SKILL.md","line_end":68,"line_start":65},{"file":"SKILL.md","line_end":71,"line_start":68},{"file":"SKILL.md","line_end":86,"line_start":71},{"file":"SKILL.md","line_end":89,"line_start":86},{"file":"SKILL.md","line_end":102,"line_start":89},{"file":"SKILL.md","line_end":105,"line_start":102},{"file":"SKILL.md","line_end":108,"line_start":105},{"file":"SKILL.md","line_end":112,"line_start":108},{"file":"SKILL.md","line_end":126,"line_start":112},{"file":"SKILL.md","line_end":129,"line_start":126},{"file":"SKILL.md","line_end":141,"line_start":129},{"file":"SKILL.md","line_end":146,"line_start":141},{"file":"SKILL.md","line_end":147,"line_start":146},{"file":"SKILL.md","line_end":151,"line_start":147},{"file":"SKILL.md","line_end":151,"line_start":151},{"file":"SKILL.md","line_end":161,"line_start":152}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Security-Sensitive Scripts Are Missing","locations":[{"file":"SKILL.md","line_end":42,"line_start":25},{"file":"SKILL.md","line_end":163,"line_start":154}],"confidence":0.98,"description":"SKILL.md directs users to authentication and calendar scripts that are not packaged. Their OAuth, token, network, and mutation behavior cannot be inspected.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The audited package contains only SKILL.md, while these lines explicitly reference scripts/auth.py, scripts/gcal.py, keyring storage, and remote token refresh."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":169,"audit_model":"codex","audited_at":"2026-07-24T00:39:27.656+00:00","created_at":"2026-07-26T13:25:16.912817+00:00","static_findings":[{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":28,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":31,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":33,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":36,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":38,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":42,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"All operations via `scripts/gcal.py`. Auto-authenticates on first use if not logged in.","category":"external_commands","line_end":45,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":47,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":50,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":62,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":65,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":68,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":71,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":86,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":89,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":102,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":105,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":108,"severity":"medium","line_start":105},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":112,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":126,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":129,"severity":"medium","line_start":126},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":141,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":146,"severity":"medium","line_start":141},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- UTC: `2024-01-15T10:30:00Z`","category":"external_commands","line_end":147,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- With offset: `2024-01-15T10:30:00-05:00` (EST)","category":"external_commands","line_end":151,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Primary calendar: Use `primary` or omit the `--calendar` flag","category":"external_commands","line_end":151,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Other calendars: Use the calendar ID from `list-calendars` (usually an email address)","category":"external_commands","line_end":161,"severity":"medium","line_start":152}],"finding_verdicts":[{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"Line 26 is an opening Markdown fence labeled bash. It is documentation formatting, not a Ruby backtick expression or executable construct.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"Line 28 is a closing Markdown code fence. It does not invoke a shell or evaluate enclosed text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"Line 31 opens a documented bash example with a Markdown fence. No backtick-based command execution is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"Line 33 closes a Markdown code block. The triple backticks are static prose delimiters.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"Line 36 is an opening Markdown bash fence for a logout example. It cannot execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"Line 38 is a closing Markdown fence. There is no Ruby or shell backtick substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The backticks on line 42 format the relative path scripts/gcal.py as inline code. They are not an execution operator.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"Line 45 opens a Markdown bash example. The fence only controls document rendering.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"Line 47 closes a Markdown code block. It does not execute the documented Python command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"Line 50 is an opening Markdown bash fence for list-events examples. It is not runtime command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"Line 62 closes the list-events example block. The triple backticks have no execution semantics in Markdown.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"Line 65 opens a Markdown bash block for get-event examples. It is documentation syntax only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"Line 68 is a closing Markdown fence, not shell or Ruby execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"Line 71 opens a Markdown bash block containing create-event examples. The fence itself cannot run commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"Line 86 closes a Markdown code block. It contains no backtick evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"Line 89 is an opening Markdown bash fence for update-event examples. It is not executable syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"Line 102 closes the update-event example block. Markdown fences do not invoke external commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","reason":"Line 105 opens a Markdown bash block for delete-event examples. It has no runtime behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"Line 108 is a closing Markdown fence. No Ruby or shell backtick execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"Line 112 opens a Markdown bash block for availability examples. The triple backticks are formatting.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","reason":"Line 126 closes a Markdown code block. It does not execute its contents.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"Line 129 opens a Markdown bash block for invitation responses. It is documentation syntax only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","reason":"Line 141 closes a Markdown block. The fence cannot invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"The backticks on line 146 format an ISO 8601 timestamp as inline code. The value is data, not a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"The backticks on line 147 format a timestamp with a timezone offset. They do not perform command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"The backticks on line 151 mark primary and --calendar as inline literals. No executable expression is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","reason":"The backticks on line 152 format the list-calendars command name. This is static Markdown text, not execution.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Security-Sensitive Scripts Are Missing","severity":"medium","locations":[{"file":"SKILL.md","line_end":42,"line_start":25},{"file":"SKILL.md","line_end":163,"line_start":154}],"confidence":0.98,"description":"SKILL.md directs users to authentication and calendar scripts that are not packaged. Their OAuth, token, network, and mutation behavior cannot be inspected.","confidence_reasoning":"The audited package contains only SKILL.md, while these lines explicitly reference scripts/auth.py, scripts/gcal.py, keyring storage, and remote token refresh."}],"subject_marketplace_commit_sha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","subject_content_hash":"8999e70f4ebee6cacdc19d5dab649efd61d7c20817da14b22a946bc902b4abf8","subject_tree_hash":"495a09e716b569c0e2c3241b3e8735bd5c1b7b15899ac8982c6f488514f1cd2a","subject_plugin_path":"skills/sickn33/google-calendar-automation","audit_payload_hash":"a15e21dbe32eba33ca35e603bb8e75df","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","contentHash":"8999e70f4ebee6cacdc19d5dab649efd61d7c20817da14b22a946bc902b4abf8","treeHash":"495a09e716b569c0e2c3241b3e8735bd5c1b7b15899ac8982c6f488514f1cd2a","pluginPath":"skills/sickn33/google-calendar-automation","auditPayloadHash":"a15e21dbe32eba33ca35e603bb8e75df"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-google-calendar-automation/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}