The Agent Skills Directory

[SAFE]: No signs of prompt injection, obfuscation, or malicious data exfiltration were found across the skill's instruction files. Documentation includes safe practices for credential management, such as using environment variables or the CLI's native auth flows.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data from Bitbucket, including pull request descriptions, diff content, issue bodies, and comments. This constitutes an attack surface for indirect prompt injection.
Ingestion points: Commands such as bkt pr view, bkt pr diff, bkt issue view, and MCP tools like bkt_get_pull_request and bkt_get_pull_request_diff.
Boundary markers: The documentation in rules/mcp.md explicitly warns the agent that descriptions and diff content are untrusted Bitbucket-authored data.
Capability inventory: Subprocess execution for the CLI, network operations via the Bitbucket API, project and repository modification, and permission management (bkt perms).
Sanitization: The skill warns the agent to treat external content as untrusted, though the instructions do not implement specific delimiters for all outputs.
[COMMAND_EXECUTION]: The skill provides subcommands for managing extensions (bkt extension) and agent skills (bkt skill) which involve cloning and executing content from Bitbucket repositories. These are documented features intended for repository management and workflow automation.

bkt