Skills bitbucket-automation
📦

bitbucket-automation

Content revision r2 High Risk ⚙️ External commands🌐 Network access

Automate Bitbucket Workflows Safely

Bitbucket administration requires many API calls, identifiers, and parameter formats. This skill coordinates repository, branch, pull request, review, and issue workflows through Rube MCP.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "bitbucket-automation" from https://skillstore.io/skills/sickn33-bitbucket-automation.md and its manifest at https://skillstore.io/api/skills/sickn33-bitbucket-automation/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-bitbucket-automation.md Signed manifest GET /api/skills/sickn33-bitbucket-automation/manifest Signed lockfile GET /api/skills/sickn33-bitbucket-automation/lockfile

Test it

Using "bitbucket-automation". List open pull requests for the payments repository.

Expected outcome:

  • Found 7 open pull requests across one results page.
  • Three requests target the main branch, and two have no reviewers.
  • No changes were made.

Using "bitbucket-automation". Review pull request 184 and prepare comments.

Expected outcome:

The review found two possible defects and one missing test. Three comments are drafted and awaiting approval before posting.

Using "bitbucket-automation". Create a feature branch from the latest approved commit.

Expected outcome:

The workspace, repository, and full commit hash were resolved. The new branch was created and verified in Bitbucket.

Security Audit

High Risk
v5 • 8/14/2026 Open versioned report

All 118 shell-execution alerts are false positives caused by Markdown backticks, and the key-file and reconnaissance alerts are also false positives. The skill still requires an external MCP connection with Bitbucket OAuth and supports irreversible remote deletion.

1
Files scanned
233
Lines analyzed
1
Review items
0
False positives ignored

Confirmed security concerns (2)

High
SKILL.md:21-26
Third-Party OAuth Delegation
The workflow sends authenticated Bitbucket operations through Rube MCP and Composio. This intermediary may access repository metadata, source changes, issues, and workspace membership.
The setup explicitly connects an external MCP endpoint and completes Bitbucket OAuth. The documented workflows then use that connection for repository operations.
High
SKILL.md:198-201
Irreversible Remote Deletion
The skill can permanently delete Bitbucket repositories and issues. It requests user confirmation, but execution still has a substantial destructive impact.
The skill explicitly identifies repository and issue deletion as permanent and instructs the agent to confirm before execution.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
SKILL.md:21
Hardcoded URL
**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API k
The skill explicitly directs users to connect to the external Rube MCP endpoint. This expected integration delegates authenticated Bitbucket operations to a third party.

Risk Factors

⚙️ External commands (50)
SKILL.md:16 SKILL.md:17 SKILL.md:21 SKILL.md:23 SKILL.md:24 SKILL.md:35 SKILL.md:36 SKILL.md:37 SKILL.md:38 SKILL.md:39 SKILL.md:40 SKILL.md:41 SKILL.md:42 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:54 SKILL.md:55 SKILL.md:56 SKILL.md:57 SKILL.md:58 SKILL.md:65 SKILL.md:66 SKILL.md:67 SKILL.md:68 SKILL.md:69 SKILL.md:72 SKILL.md:73 SKILL.md:74 SKILL.md:75 SKILL.md:76 SKILL.md:77 SKILL.md:78 SKILL.md:81 SKILL.md:82 SKILL.md:83 SKILL.md:84 SKILL.md:85 SKILL.md:92 SKILL.md:93 SKILL.md:94 SKILL.md:95 SKILL.md:96 SKILL.md:99 SKILL.md:100 SKILL.md:101
🌐 Network access (1)
SKILL.md:21
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-bitbucket-automation/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-bitbucket-automation/security.svg)](https://skillstore.io/skills/sickn33-bitbucket-automation?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-bitbucket-automation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-bitbucket-automation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-bitbucket-automation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). bitbucket-automation security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-bitbucket-automation/audits/5

BibTeX citation

@techreport{sickn33-sickn33-bitbucket-automation-2026, author = {sickn33}, title = {bitbucket-automation security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/sickn33-bitbucket-automation/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "bitbucket-automation security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-08-14" url: "https://skillstore.io/skills/sickn33-bitbucket-automation/audits/5" identifiers: - type: other value: "skillstore:sickn33-bitbucket-automation:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance

What You Can Build

Prepare a Pull Request

Resolve repository branches, create a pull request, and assign reviewers using verified workspace member identifiers.

Review Repository Activity

List repositories, branches, pull requests, and issues with filters and complete pagination.

Standardize Issue Triage

Find matching issues, update priorities and states, and add consistent comments across a repository.

Try These Prompts

List My Repositories 
List repositories in workspace [workspace]. Include visibility, main branch, and last update. Read every results page.
Create a Pull Request 
In [workspace]/[repository], verify [source] and [destination]. Create a pull request titled [title] and assign [reviewers].
Review Pull Request Changes 
Inspect pull request [id] in [workspace]/[repository]. Summarize risks and draft inline comments. Ask before posting any comment.
Run Filtered Issue Triage 
Find all [priority] issues in [workspace]/[repository]. Propose state and assignee updates, then request approval before applying each group.

Best Practices

  • Resolve workspace, repository, branch, member, and commit identifiers before starting write operations.
  • Review the current Rube tool schema before constructing parameters or relying on documented defaults.
  • Display exact targets and obtain explicit confirmation before deletion or broad updates.

Avoid

  • Do not delete repositories or issues without naming the exact target and receiving immediate confirmation.
  • Do not assume the destination branch is main or use branch names where a full commit hash is required.
  • Do not stop after the first page when the user requests complete results.

Frequently Asked Questions

What connection does this skill require?
It requires the Rube MCP endpoint and an active Bitbucket OAuth connection managed through Rube.
Can it work with private repositories?
Yes, when the connected Bitbucket account and OAuth scopes permit access to those repositories.
Can it create and review pull requests?
Yes. It can create requests, inspect details and diffs, list changed files, and post review comments.
Does it support issue management?
Yes. It can list, create, update, comment on, and permanently delete issues when the tracker is enabled.
How does it handle large result sets?
It uses Bitbucket page and page-length parameters and checks for additional pages before reporting complete results.
What actions require special caution?
Repository deletion, issue deletion, broad updates, public repository creation, and posted comments require careful target review and approval.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/bitbucket-automation

Ref

5a26d1d61d694db29af9b138c661c1981076d9df

Maintenance freshness

8/15/2026

Usage

7 downloads · 143 views

File structure

📄 SKILL.md