The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/bitbucket_server_pr.py retrieves sensitive credentials, including Bitbucket passwords and tokens, from environment variables (e.g., BB_PASSWORD, BB_CLOUD_PASSWORD, BB_SERVER_PASSWORD) and uses them in plaintext for Basic and Bearer authentication.
[DATA_EXFILTRATION]: The skill dynamically determines the API target host from the local repository's git remote URL. It sends the gathered authentication credentials to this host without domain verification or whitelisting. This allows a malicious git remote to exfiltrate the user's Bitbucket credentials to an untrusted server.
[DYNAMIC_EXECUTION]: The skill uses importlib.util to load and execute an external Python module from a runtime-computed path (../../pr-writing/scripts/pr_writer.py). This dynamic loading of code from sibling directories increases the attack surface and relies on the integrity of the broader filesystem environment.
[COMMAND_EXECUTION]: The script interacts with the git CLI using subprocess.run. While it avoids shell=True, the arguments for repository directory and remote are sourced directly from command-line flags, which could be exploited for argument injection into the git process.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (Bitbucket PR descriptions, diffs, and file contents) and presents it to the agent, creating a surface for indirect prompt injection.
Ingestion points: Functions get_pr, pr_changes, pr_diff, and repo_file in scripts/bitbucket_server_pr.py fetch external content via API.
Capability inventory: The skill can perform authenticated API mutations (create, update, approve PRs), read local files, and execute git commands.
Boundary markers: There are no protective delimiters or instructions to prevent the agent from obeying malicious instructions embedded in the PR data.
Sanitization: No sanitization, escaping, or validation is performed on the ingested text before it is returned to the agent context.

bitbucket-helper