bitbucket

SUSPICIOUS: the skill is purpose-aligned and uses a verifiable same-org npm CLI, but it routes Bitbucket access and action execution through ClawLink as a third-party intermediary that stores/uses the effective Bitbucket auth. That broader trust and mediated data flow are not inherently malicious, yet they are materially higher risk than a direct official Bitbucket integration.