Security audit
Security checks for vulnerabilities and agentic risk
This Bitbucket review skill is mostly coherent and read-only against Bitbucket, but it mandates saving potentially sensitive PR review output locally for email automation while privacy text understates that persistence.
Review before installing. Use only a narrowly scoped read-only Bitbucket token, and assume the skill can read PR diffs, comments, commit metadata, repository files, and branch listings available to that token. Also expect it to save review Markdown under the skill's reviews directory, where it may contain sensitive repository details and may be picked up by email automation.
The document claims there is no local file I/O, yet it later requires writing PR review content to disk. This mismatch is dangerous because operators may trust the earlier privacy claim and expose repository-derived content to local storage and downstream automation without informed consent.
The instruction to always overwrite a local review file is a write/modify behavior that can clobber prior artifacts and be abused to replace trusted outputs consumed by later automation. In this skill's context, the danger is less about code self-modification and more about unguarded local file modification of repository-derived review artifacts.
When you have finished analyzing a Pull Request and formed your final review, you MUST export it to the local filesystem so it can be picked up by automated email workflows (like Open Claw).
{baseDir}/reviews/<REPO_SLUG>-<PR_ID>.md. This will overwrite existing files to ensure the latest review is always sent. Ensure the reviews/ directory is created if it does not exist.The skill declares shell and network-capable behavior but does not define an explicit tool scope such as allowed-tools or permissions. In practice this increases the chance an agent can invoke broader-than-intended capabilities when handling repository and PR data, weakening least-privilege boundaries.
The skill instructs the agent to export PR reviews to disk without warning that the content originates from potentially sensitive repository diffs, comments, and file contents. That creates a quiet secondary disclosure path where proprietary code, secrets present in diffs, or sensitive review commentary may be stored and redistributed.
Mandating export of full PR review content for downstream email workflows creates a clear data disclosure channel outside Bitbucket. Because reviews summarize and quote repository changes, this can propagate sensitive code or internal context into less-controlled storage and transport systems.
The external-endpoints section frames the skill as only performing HTTPS GET requests to Bitbucket, but the skill also mandates local filesystem output. This incomplete disclosure can cause reviewers to underestimate the data exposure surface, especially where local review files are harvested by other workflows such as email systems.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# - BITBUCKET_WORKSPACE (workspace slug for API URL construction)
#
# External endpoints called:
# - https://api.bitbucket.org/2.0/* (Bitbucket Cloud REST API, read-only)
#
# Local files read/written:
# - None. All output goes to stdout/stderr.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# - BITBUCKET_WORKSPACE (workspace slug for API URL construction)
#
# External endpoints called:
# - https://api.bitbucket.org/2.0/* (Bitbucket Cloud REST API, read-only)
#
# Local files read/written:
# - None. All output goes to stdout/stderr.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# - BITBUCKET_WORKSPACE (workspace slug for API URL construction)
#
# External endpoints called:
# - https://api.bitbucket.org/2.0/* (Bitbucket Cloud REST API, read-only)
#
# Local files read/written:
# - None. All output goes to stdout/stderr.
This instruction forces a specific repository naming convention as the default behavior rather than prompting for or detecting the appropriate branch. Although not a regional locale issue, it is a natural-language default constraint imposed without user choice and may conflict with repositories that use other default branches.
No suspicious patterns detected.