📦 Snowsand Bitbucket — Bitbucket API交互
v1.0.0通过 REST API 全面管理 Bitbucket Cloud：仓库创建、分支操作、拉取请求全流程（列出、查看、创建、评论、审批、合并）一站式完成，让团队协作更高效。
0· 201·0 当前·0 累计
by 下载技能包
最后更新
2026/4/20
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to be a legitimate Bitbucket Cloud CLI, but there are two issues to consider before installing: (1) the registry metadata does not list the required environment variables, yet the code requires BITBUCKET_USERNAME and BITBUCKET_APP_PASSWORD (and optionally BITBUCKET_WORKSPACE). Ask the publisher to correct the metadata so you know what will be requested. (2) The App Password requested needs repository and pull-request write permissions to perform create/merge/delete operations ...详细分析 ▾
⚠ 用途与能力
The skill's name, description, SKILL.md, references/api.md, and scripts/bitbucket.py are consistent with a Bitbucket Cloud integration. However the registry metadata claims 'Required env vars: none' while both SKILL.md and scripts/bitbucket.py require BITBUCKET_USERNAME and BITBUCKET_APP_PASSWORD (and optionally BITBUCKET_WORKSPACE). That metadata omission is an incoherence.
✓ 指令范围
The SKILL.md instructions and the CLI script confine activity to Bitbucket Cloud REST API calls. The runtime instructions and code only reference environment variables for authentication and the Bitbucket API endpoints; they do not instruct reading unrelated system files or sending data to unexpected external endpoints.
✓ 安装机制
This is an instruction-only skill with an included Python script; there is no install spec, no downloads, and no archive extraction. Nothing in the manifest indicates code will be pulled from arbitrary URLs or installed system-wide.
⚠ 凭证需求
The script requires BITBUCKET_USERNAME and BITBUCKET_APP_PASSWORD and SKILL.md also recommends BITBUCKET_WORKSPACE. Those credentials are appropriate for Bitbucket API access, but the App Password needs Write permissions for repositories and pull requests to support create/merge/delete actions — granting such an App Password is powerful (can modify/delete repositories, merge PRs, trigger pipelines). The registry failing to declare these env vars is a mismatch that reduces transparency.
✓ 持久化与权限
The skill is not marked always:true and does not request system-wide persistence or modify other skills. It only uses environment variables for auth and performs API calls; autonomous invocation is allowed by default but not excessive given the skill purpose.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/16
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install snowsand-bitbucket
镜像加速npx clawhub@latest install snowsand-bitbucket --registry https://cn.longxiaskill.com