Bitbucket Toolbox

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:34 AM UTC
• Version: 1.1.2

Overview

This Bitbucket review skill is mostly coherent and read-only against Bitbucket, but it mandates saving potentially sensitive PR review output locally for email automation while privacy text understates that persistence.

Review before installing. Use only a narrowly scoped read-only Bitbucket token, and assume the skill can read PR diffs, comments, commit metadata, repository files, and branch listings available to that token. Also expect it to save review Markdown under the skill's reviews directory, where it may contain sensitive repository details and may be picked up by email automation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The document claims there is no local file I/O, yet it later requires writing PR review content to disk. This mismatch is dangerous because operators may trust the earlier privacy claim and expose repository-derived content to local storage and downstream automation without informed consent.

Self-Modification

High

• Category: Rogue Agent

Content

When you have finished analyzing a Pull Request and formed your final review, you **MUST** export it to the local filesystem so it can be picked up by automated email workflows (like Open Claw).

### Export Instructions:
1. **Target Path:** Always save your review to `{baseDir}/reviews/<REPO_SLUG>-<PR_ID>.md`. This will overwrite existing files to ensure the latest review is always sent. Ensure the `reviews/` directory is created if it does not exist.
2. **Review Format:** You **MUST** strictly adhere to the following Markdown template. Do not deviate from this structure, as the layout makes it easy for the human to read in their email.

```markdown

• Confidence: 92% confidence
• Finding: The instruction to always overwrite a local review file is a write/modify behavior that can clobber prior artifacts and be abused to replace trusted outputs consumed by later automation. In this skill's context, the danger is less about code self-modification and more about unguarded local file modification of repository-derived review artifacts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares shell and network-capable behavior but does not define an explicit tool scope such as allowed-tools or permissions. In practice this increases the chance an agent can invoke broader-than-intended capabilities when handling repository and PR data, weakening least-privilege boundaries.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to export PR reviews to disk without warning that the content originates from potentially sensitive repository diffs, comments, and file contents. That creates a quiet secondary disclosure path where proprietary code, secrets present in diffs, or sensitive review commentary may be stored and redistributed.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Mandating export of full PR review content for downstream email workflows creates a clear data disclosure channel outside Bitbucket. Because reviews summarize and quote repository changes, this can propagate sensitive code or internal context into less-controlled storage and transport systems.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The external-endpoints section frames the skill as only performing HTTPS GET requests to Bitbucket, but the skill also mandates local filesystem output. This incomplete disclosure can cause reviewers to underestimate the data exposure surface, especially where local review files are harvested by other workflows such as email systems.

External Transmission

Medium

• Category: Data Exfiltration

Content

#   - BITBUCKET_WORKSPACE  (workspace slug for API URL construction)
#
# External endpoints called:
#   - https://api.bitbucket.org/2.0/*  (Bitbucket Cloud REST API, read-only)
#
# Local files read/written:
#   - None. All output goes to stdout/stderr.

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#   - BITBUCKET_WORKSPACE  (workspace slug for API URL construction)
#
# External endpoints called:
#   - https://api.bitbucket.org/2.0/*  (Bitbucket Cloud REST API, read-only)
#
# Local files read/written:
#   - None. All output goes to stdout/stderr.

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#   - BITBUCKET_WORKSPACE  (workspace slug for API URL construction)
#
# External endpoints called:
#   - https://api.bitbucket.org/2.0/*  (Bitbucket Cloud REST API, read-only)
#
# Local files read/written:
#   - None. All output goes to stdout/stderr.

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: This instruction forces a specific repository naming convention as the default behavior rather than prompting for or detecting the appropriate branch. Although not a regional locale issue, it is a natural-language default constraint imposed without user choice and may conflict with repositories that use other default branches.

Static analysis

No suspicious patterns detected.