ClawHub
Back to skill

Security audit

Bitbucket

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed read-only Bitbucket helper, but users should limit the Bitbucket token because it can read repository code and PR data the token can access.

Install only if you want the agent to read Bitbucket repositories, pull requests, comments, diffs, branch metadata, and source files available to the configured token. Use a separate Bitbucket token with read-only repository and pull-request scopes, limit workspace access where possible, and be explicit when you want the skill to access Bitbucket versus local or other-hosted code.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill metadata says it is for browsing Bitbucket repos, reviewing PRs, reading diffs, and checking branches, but the implementation also allows arbitrary file reads, recursive tree listing, full repo directory enumeration, and code search across a workspace. In an agent setting, that scope expansion materially increases data exposure risk because a user asking about a PR could cause the agent to access unrelated source files or sensitive code outside the stated purpose.

Vague Triggers

Medium
Confidence
70% confidence
Finding
The invocation text is broad enough that the skill may activate on generic repository-related prompts, causing it to access Bitbucket data when the user did not clearly intend this tool. In a source-code environment, over-broad triggering can unnecessarily expose private repository metadata, code, branch names, commit messages, or PR discussions to the agent workflow.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.