Audit History

All static findings are false positives caused by Markdown backticks, code fences, and relative links to sibling skill documentation. No prompt injection or malicious intent was found.

All static findings were adjudicated as false positives. The external command detections are Markdown formatting and gws CLI examples, while the filesystem detections are fixed sibling documentation links with no user-controlled traversal or sensitive file access. No prompt injection, data exfiltration, or malicious intent was found in SKILL.md.

All static findings were adjudicated as false positives. The external command detections are Markdown formatting and gws CLI examples, while the filesystem detections are fixed sibling documentation links with no user-controlled traversal or sensitive file access. No prompt injection, data exfiltration, or malicious intent was found in SKILL.md.

Static analysis flagged shell-style command examples, relative documentation links, and weak-crypto patterns. Review found no malicious intent, no prompt injection, and no cryptographic code; the real concern is that this skill instructs an external Google Workspace CLI to create calendar events, which is a write action requiring user confirmation.

Static analyzer detected patterns in SKILL.md (backticks, path references, crypto-like strings) but all are FALSE POSITIVES. The file is Markdown documentation, not executable code. Backticks are inline code formatting, path references are relative documentation links, and no actual shell execution occurs. The skill wraps the official gws CLI tool and requires user confirmation before write operations. Single risk factor: external_commands (legitimate CLI invocation).