The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/bitbucket_server_pr.py dynamically imports and executes a module named pr_writer from a relative file path (../../pr-writing/scripts/pr_writer.py). This dynamic loading from a computed path outside the skill's own directory presents a potential security risk if the environment structure is manipulated.
[COMMAND_EXECUTION]: The skill uses subprocess.run to execute local git commands. Although it passes arguments as a list to prevent shell injection, the ability to invoke local binaries based on user-supplied repository directories grants significant local execution power.
[DATA_EXFILTRATION]: The create and update commands include a --description-file argument that allows the skill to read content from an arbitrary local file path using Path.read_text. This capability could be misused to read sensitive system files (e.g., credentials or configuration files) and transmit their contents to Bitbucket servers via pull request API calls.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data retrieved from external Bitbucket repositories, such as diffs, commit messages, and pull request descriptions. This data is formatted and presented to the agent, creating a surface for indirect prompt injection attacks.
Ingestion points: Untrusted data enters the agent context via API calls in get_pr, pr_diff, repo_file, pr_changes, and pr_commits within scripts/bitbucket_server_pr.py.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat external PR content as potentially untrusted data.
Capability inventory: The skill has access to local file reading, network operations (via urllib), and command execution (git).
Sanitization: The script includes a preview function that truncates long output strings, but it does not perform sanitization or escaping of characters that might influence the agent's behavior.

bitbucket-helper