Gws Forms

Read and write Google Forms.

Security Scan

The skill's stated purpose (read/write Google Forms) matches its use of a 'gws' CLI, but its runtime instructions refer to an external shared SKILL.md for authentication and global flags while declaring no credentials or config requirements — an inconsistency that could hide where and how Google credentials are accessed.

Purpose & Capability

Name/description (Google Forms read/write) align with requiring the 'gws' CLI; asking for a gws binary is reasonable. However, the skill manifest declares no credentials or config paths while the SKILL.md explicitly instructs the agent to read a sibling file (../gws-shared/SKILL.md) for auth and security rules, which is not declared in the registry metadata.

Instruction Scope

Runtime instructions tell the agent to run 'gws forms ...' and to inspect schemas — appropriate for a CLI-backed Forms skill. But they also instruct the agent to read ../gws-shared/SKILL.md for authentication and security rules; that directive requires accessing a file outside the skill and potentially exposes or depends on credentials/config the registry does not list.

Install Mechanism

Instruction-only skill with no install spec and no code files means nothing is downloaded or written by the skill itself — low install risk. The security surface is the external 'gws' binary and whatever it does.

Credentials

The skill declares no required environment variables or primary credential, yet the SKILL.md defers authentication to an external shared SKILL.md. That omission means the registry metadata doesn't tell you what secrets or local config will actually be used (OAuth tokens, service account keys, or stored CLI credentials).

Persistence & Privilege

always:false and no install steps are normal. Still, instructions explicitly reference another skill's file path (../gws-shared/SKILL.md), which implies read access to sibling skill configuration; the manifest did not declare any cross-skill config access, creating a privilege/visibility gap.

What to consider before installing

This skill looks like a thin wrapper around a 'gws' CLI for Google Forms, but its SKILL.md tells the agent to read an external ../gws-shared/SKILL.md for authentication and rules while the registry lists no credentials or config paths. Before installing, verify: 1) where and how the 'gws' CLI gets authenticated (local OAuth cache, service account files, or env vars), 2) whether a ../gws-shared/SKILL.md exists in your environment and what secrets it contains, and 3) the provenance and trustworthiness of the 'gws' binary (who built it and where it came from). If you can't confirm those, run the skill in a sandboxed environment and avoid providing broad Google credentials. Ask the publisher to declare required env vars/config paths or to bundle clear auth instructions so you can audit exactly which credentials the skill will use.

forms (v1)

PREREQUISITE: Read ../gws-shared/SKILL.md for auth, global flags, and security rules. If missing, run gws generate-skills to create it.

gws forms <resource> <method> [flags]

API Resources

forms

• batchUpdate — Change the form with a batch of updates.
• create — Create a new form using the title given in the provided form message in the request. Important: Only the form.info.title and form.info.document_title fields are copied to the new form. All other fields including the form description, items and settings are disallowed. To create a new form and add items, you must first call forms.create to create an empty form with a title and (optional) document title, and then call forms.update to add the items.
• get — Get a form.
• setPublishSettings — Updates the publish settings of a form. Legacy forms aren't supported because they don't have the publish_settings field.
• responses — Operations on the 'responses' resource
• watches — Operations on the 'watches' resource

Discovering Commands

Before calling any API method, inspect it:

# Browse resources and methods
gws forms --help

# Inspect a method's required params, types, and defaults
gws schema forms.<resource>.<method>

Use gws schema output to build your --params and --json flags.