Trust Assessment
bitbucket-automation received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Broad Bitbucket tool access including irreversible destructive operations.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Broad Bitbucket tool access including irreversible destructive operations The skill provides access to a comprehensive set of Bitbucket management tools, enabling an agent to perform a wide range of actions from listing resources to creating, updating, and deleting them. Specifically, it exposes `BITBUCKET_DELETE_REPOSITORY` (line 100) and `BITBUCKET_DELETE_ISSUE` (line 153), both explicitly described as 'irreversible' or 'permanent with no undo'. If an agent using this skill is compromised, it could be coerced into performing extensive and irreversible damage across Bitbucket workspaces and repositories. The skill itself does not define permissions, but it exposes the interface to tools that, when granted permissions via OAuth, allow for broad control. Implement granular access control for the underlying Bitbucket connection, if possible, to restrict the agent's capabilities to only what is strictly necessary. For example, if an agent only needs to create pull requests, do not grant it repository deletion permissions. Additionally, implement strong user confirmation steps for destructive operations within the agent's workflow before execution. | LLM | SKILL.md:100 |
Scan History
Embed Code
[](https://skillshield.io/report/263cf88621f2db5c)
Powered by SkillShield