📦

Audit History

bitbucket-automation - 5 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v5 LatestAug 14, 2026, 10:32 AM 2 confirmed1No capability change
v4 Jul 5, 2026, 11:30 PM No confirmed findings0No capability change
v3 Jul 5, 2026, 11:30 PM No confirmed findings0External commands
v2 Jun 30, 2026, 01:12 PM 1 confirmed1 External commands
v1 Feb 25, 2026, 04:19 AM No confirmed findings0Baseline

Aug 14, 2026, 10:32 AM

All 118 shell-execution alerts are false positives caused by Markdown backticks, and the key-file and reconnaissance alerts are also false positives. The skill still requires an external MCP connection with Bitbucket OAuth and supports irreversible remote deletion.

1
Files scanned
233
Lines analyzed
5
Review items
0
False positives ignored

Confirmed security concerns (2)

High
Third-Party OAuth Delegation
The workflow sends authenticated Bitbucket operations through Rube MCP and Composio. This intermediary may access repository metadata, source changes, issues, and workspace membership.
The setup explicitly connects an external MCP endpoint and completes Bitbucket OAuth. The documented workflows then use that connection for repository operations.
High
Irreversible Remote Deletion
The skill can permanently delete Bitbucket repositories and issues. It requests user confirmation, but execution still has a substantial destructive impact.
The skill explicitly identifies repository and issue deletion as permanent and instructs the agent to confirm before execution.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
Hardcoded URL
**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API k
The skill explicitly directs users to connect to the external Rube MCP endpoint. This expected integration delegates authenticated Bitbucket operations to a third party.
Audited by: codex

Jul 5, 2026, 11:30 PM

The static analyzer flagged Markdown inline code spans, a documented MCP endpoint, a BBQL project.key example, and BBQL field guidance. Manual review found no prompt injection, credential exposure, hidden command execution, or malicious intent in SKILL.md.

1
Files scanned
225
Lines analyzed
2
Review items
0
False positives ignored

Risk Factors

⚙️ External commands (118)
🌐 Network access (1)
Audited by: codex

Jul 5, 2026, 11:30 PM

The static analyzer flagged Markdown inline code spans, a documented MCP endpoint, a BBQL project.key example, and BBQL field guidance. Manual review found no prompt injection, credential exposure, hidden command execution, or malicious intent in SKILL.md.

1
Files scanned
225
Lines analyzed
2
Review items
0
False positives ignored

Risk Factors

⚙️ External commands (118)
🌐 Network access (1)
Audited by: codex

Jun 30, 2026, 01:12 PM

Static command-execution, weak-crypto, certificate, and reconnaissance findings are false positives caused by Markdown backticks, tool names, BBQL examples, and SHA1 commit-hash documentation. The confirmed risks are legitimate third-party MCP network access and documented irreversible Bitbucket delete operations, so the skill should publish with a warning.

1
Files scanned
225
Lines analyzed
3
Review items
2
False positives ignored

Confirmed security concerns (1)

Medium
Irreversible Bitbucket Delete Operations
The skill documents repository and issue deletion workflows and states that these actions are permanent. This is not malicious, but users could lose repository or issue data if the assistant runs these operations without clear confirmation.
The delete capabilities and warnings are directly documented. The risk is operational rather than malicious because the skill also tells the assistant to confirm before delete operations.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Third-Party MCP and OAuth Access
The skill requires Rube MCP and instructs users to connect Bitbucket through RUBE_MANAGE_CONNECTIONS. This is intended functionality, but it grants a third-party MCP service access to Bitbucket workspace, repository, pull request, issue, and member data.
The MCP endpoint and Bitbucket connection workflow are explicit in the skill instructions. The behavior appears legitimate for Bitbucket automation, but it materially expands data access through an external service.
Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
Static Command Execution Findings Are Markdown False Positives
The many Ruby or shell backtick findings come from Markdown inline code spans that name Rube and Bitbucket MCP tools, parameters, enum values, and examples. No evidence found of Ruby code, shell commands, command substitution, or local process execution in the scanned file.
Manual review shows these lines are documentation bullets and tables, not executable code. The skill file contains only Markdown guidance and MCP tool names.
Low
Crypto, Certificate, and Reconnaissance Findings Are Documentation False Positives
The weak-crypto alerts correspond to commit hash or parameter documentation, and the sensitive or reconnaissance alerts correspond to BBQL examples such as project.key and repository field names. No evidence found of cryptographic operations, private key handling, certificate files, or host reconnaissance.
The flagged text is visible in parameter and pitfall documentation. It does not create or use keys, algorithms, certificates, or system discovery commands.

Risk Factors

Detected Patterns

External MCP Network DependencyDocumented Destructive Actions
Audited by: codex

Feb 25, 2026, 04:19 AM

All 271 static findings are false positives from Markdown code formatting. The file is documentation-only with no executable code. External command detections are backticks around tool names, not actual execution. The single network reference is a legitimate MCP endpoint URL. Skill safely provides Bitbucket automation workflows through Rube MCP server.

1
Files scanned
230
Lines analyzed
2
Review items
1
False positives ignored
Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
Static Analysis False Positives
271 'external_commands' detections are Markdown backticks formatting tool names (e.g., `BITBUCKET_LIST_WORKSPACES`), not actual code execution. The file is documentation-only SKILL.md with no executable content.
Confirmed by reading file - backticks wrap tool names in Markdown documentation, no executable code present

Risk Factors

⚙️ External commands (1)
🌐 Network access (1)
Audited by: claude