bitbucket-browser-fetch
Fail
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Missing Critical Implementation Dependency. The main script 'scripts/bitbucket-browser-fetch.js' requires a local module './atlassian-browser' which is not included in the skill files. Because this module contains the 'createBrowserSession' logic responsible for browser interaction and cookie harvesting, its absence constitutes an unverifiable dependency that could contain malicious logic.
- [DATA_EXFILTRATION]: Browser Session Harvesting. The skill is designed to programmatically extract active session cookies from a user's running browser instance using the Chrome DevTools Protocol. This represents a significant security risk as it bypasses Multi-Factor Authentication (MFA) and SSO by stealing authenticated session tokens.
- [COMMAND_EXECUTION]: Dynamic Executable Generation. The script programmatically creates a shell script ('clone-ssh.sh') and explicitly sets its file system permissions to executable (0o755). While the skill documentation states this script is for manual use, generating executable code from an agent context is a high-risk pattern.
- [CREDENTIALS_UNSAFE]: Access to Sensitive Browser Profiles. The skill accesses and manipulates browser profile directories (defaulting to '~/.local/share/bitbucket-browser-fetch-chrome'). These directories contain sensitive site data, databases, and potentially credentials for other services if the profile is shared or incorrectly configured.
Recommendations
- AI detected serious security threats
Audit Metadata