bitbucket-workflow
https://raw.githubusercontent.com/mindrally/skills/main/bitbucket-workflow/SKILL.md
github.com/mindrally/skills
Scanned Thu, 28 May 2026 17:38:26 GMT
Scan ID crawl-igpli6432xx3uw4y4902rveq · 1ms
F
SCORE 0 / 100
Verdict: Do not install

4 critical findings.

This skill exfiltrates environment secrets ($AWS_ACCESS_KEY_ID) plus 4 other issues listed below.

4 critical0 high1 medium7 rules passed

Why grade F?

score · 0 / 100

The current grade reflects 4 critical findings (any 2+ CRITs → F).

4 CRIT0 HIGH1 MED0 LOW
To reach a higher grade
  • D
    Reach Dtarget score 30

    Resolve 3 of your 4 CRIT findings — any single CRIT still keeps you at D.

  • C
    Reach Ctarget score 55

    Resolve all 4 CRIT findings.

  • B
    Reach Btarget score 75

    Resolve all 4 CRIT.

  • A
    Reach Atarget score 95

    Resolve all 4 CRIT.

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Findings · ordered by severity

crit
Skill references secret env var $AWS_ACCESS_KEY_ID
The skill instructions reference `$AWS_ACCESS_KEY_ID`, which contains a credential. If an attacker can lure the agent into including this in an outbound URL or message, the credential leaks.
rule: env-var-harvestingline: 110CWE-200
▾
108 - pipe: atlassian/aws-s3-deploy:1.1.0
109 variables:
110 AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID← references $AWS_ACCESS_KEY_ID — potential credential leak
111 AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
112 AWS_DEFAULT_REGION: 'us-east-1'
crit
Skill references secret env var $AWS_SECRET_ACCESS_KEY
The skill instructions reference `$AWS_SECRET_ACCESS_KEY`, which contains a credential. If an attacker can lure the agent into including this in an outbound URL or message, the credential leaks.
rule: env-var-harvestingline: 111CWE-200
▾
109 variables:
110 AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
111 AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY← references $AWS_SECRET_ACCESS_KEY — potential credential leak
112 AWS_DEFAULT_REGION: 'us-east-1'
113 S3_BUCKET: 'my-bucket'
crit
Skill references secret env var $AWS_ACCESS_KEY_ID
The skill instructions reference `$AWS_ACCESS_KEY_ID`, which contains a credential. If an attacker can lure the agent into including this in an outbound URL or message, the credential leaks.
rule: env-var-harvestingline: 176CWE-200
▾
174 - pipe: atlassian/aws-ecs-deploy:1.6.0
175 variables:
176 AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID← references $AWS_ACCESS_KEY_ID — potential credential leak
177 AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
178 AWS_DEFAULT_REGION: 'us-east-1'
crit
Skill references secret env var $AWS_SECRET_ACCESS_KEY
The skill instructions reference `$AWS_SECRET_ACCESS_KEY`, which contains a credential. If an attacker can lure the agent into including this in an outbound URL or message, the credential leaks.
rule: env-var-harvestingline: 177CWE-200
▾
175 variables:
176 AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
177 AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY← references $AWS_SECRET_ACCESS_KEY — potential credential leak
178 AWS_DEFAULT_REGION: 'us-east-1'
179 CLUSTER_NAME: 'my-cluster'
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
Scan another →Share
skillox.io/r/crawl-igpli6432xx3uw4y4902rveq