Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add quatico-solutions/agent-skills --skill working-with-bitbucket-apigit clone --depth 1 https://github.com/quatico-solutions/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/quatico-solutions/agent-skills/working-with-bitbucket-api)<a href="https://agentmods.dev/skills/quatico-solutions/agent-skills/working-with-bitbucket-api"><img src="https://agentmods.dev/badge/skills/quatico-solutions/agent-skills/working-with-bitbucket-api/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/quatico-solutions/agent-skills/working-with-bitbucket-api"><img src="https://agentmods.dev/badge/skills/quatico-solutions/agent-skills/working-with-bitbucket-api.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00157 | $0.02475 |
| Opus 5 | $0.00078 | $0.01238 |
| Sonnet 5 | $0.00031 | $0.00495 |
| Haiku 4.5 | $0.00016 | $0.00248 |
Grade A, and why
working-with-bitbucket-api scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
> **macOS tested, POSIX portable.** `bb auth login` uses macOS Keychain (`security`) and `open` — these won't work on Linux. All other commands work on any POSIX system with `curl` and `jq` if you set `BB_TOKEN` and `BB_ How it starts
The opening of the file, as written. The whole thing — 206 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Working with Bitbucket API
Bitbucket Cloud operations via the bb CLI wrapper (REST API v2, gh-style UX).
macOS tested, POSIX portable.
bb auth loginuses macOS Keychain (security) andopen— these won't work on Linux. All other commands work on any POSIX system withcurlandjqif you setBB_TOKENandBB_EMAILenv vars.
Homebrew is an official dependency of the installer.
install-dependencies.shinstallsjqvia brew and copiesbbinto$(brew --prefix)/bin(on PATH for every Homebrew user). Non-Homebrew setups:BB_INSTALL_DIR=<writable-dir-on-your-PATH> ./install-dependencies.sh— and providejqyourself.
Remote detection: If
git remote get-url origincontainsbitbucket.org, this is a Bitbucket repository — usebbCLI for all PR and source operations.
Step 0 (gate): confirm bb is installed, current, AND this skill's — before any command
Before any bb command, check more than "does it run". A bb that merely works can be an
older build — installed by a previous version of this skill — that silently lacks newer
subcommands or flags. The command then fails in a way that looks like an API or auth problem
when the real fix is a reinstall. Verify the version first:
bb --version # running version (missing counts as outdated)
grep -m1 BB_VERSION "{{SKILL_DIR}}/bin/bb" # the version THIS skill ships
If bb is missing or its version differs from the skill's BB_VERSION, reinstall — no
user approval needed, this is safe and idempotent:
bash "{{SKILL_DIR}}/install-dependencies.sh" # copies this skill's bin/bb -> $(brew --prefix)/bin/bb, checks jq
Re-run bb --version to confirm it matches, then check auth with bb auth status. If not
logged in, tell the user to run bb auth login.
Never diagnose a bb command or auth error before ruling out a version mismatch —
reinstall from this skill first. Do NOT silently fall back to curl or browser automation.
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- bin/bb 84 KB
- install-dependencies.sh 3.0 KB runs code
- README.md 2.7 KB
- tests/.build/dev/bash-coverage-wrapper 708 B
- tests/.build/dev/generate-coverage.ts 6.7 KB runs code
- tests/.build/dev/mock-server.ts 4.1 KB runs code
- tests/.build/dev/run-bb.ts 2.2 KB runs code
- tests/.gitignore 40 B
- tests/api.test.ts 5.1 KB runs code
- tests/auth-login.test.ts 3.9 KB runs code
- tests/auth-status.test.ts 2.0 KB runs code
- tests/download.test.ts 5.3 KB runs code
- tests/fixtures/bin/security 253 B
- tests/fixtures/branch-ref.json 95 B
- tests/fixtures/branches.json 520 B
- tests/fixtures/commit-single.json 389 B
- tests/fixtures/commits.json 747 B
- tests/fixtures/empty-200.json 3 B
- tests/fixtures/pr-activity.json 452 B
- tests/fixtures/pr-comments.json 910 B
- tests/fixtures/pr-create-response.json 590 B
- tests/fixtures/pr-diff-raw.txt 353 B
- tests/fixtures/pr-diffstat.json 366 B
- tests/fixtures/pr-list-merged.json 1018 B
- tests/fixtures/pr-list-open-with-commits.json 1.9 KB
- tests/fixtures/pr-list-open.json 1.5 KB
- tests/fixtures/pr-single.json 887 B
- tests/fixtures/pr-tasks.json 524 B
- tests/fixtures/repo-info.json 171 B
- tests/fixtures/search-results.json 453 B
- tests/fixtures/source-dir.json 243 B
- tests/fixtures/source-file-meta.json 67 B
- tests/fixtures/source-file.txt 63 B
- tests/fixtures/statuses-failed-then-inprogress.json 1.2 KB
- tests/fixtures/statuses-failed.json 587 B
- tests/fixtures/statuses-inprogress-then-failed.json 1.2 KB
- tests/fixtures/statuses-inprogress.json 581 B
- tests/fixtures/statuses-none.json 62 B
- tests/fixtures/statuses-successful-then-failed.json 1.1 KB
- tests/fixtures/statuses-successful.json 550 B
- tests/fixtures/tags.json 280 B
- tests/fixtures/user.json 269 B
- tests/global-flags.test.ts 3.3 KB runs code
- tests/package.json 696 B
- tests/pnpm-lock.yaml 28 KB
- tests/pr-activity.test.ts 1.8 KB runs code
- tests/pr-close.test.ts 1.4 KB runs code
- tests/pr-comment.test.ts 12 KB runs code
- tests/pr-create.test.ts 12 KB runs code
- tests/pr-diff.test.ts 2.6 KB runs code
- tests/pr-edit.test.ts 7.8 KB runs code
- tests/pr-list-checks.test.ts 9.6 KB runs code
- tests/pr-list-state-accumulate.test.ts 8.0 KB runs code
- tests/pr-list.test.ts 13 KB runs code
- tests/pr-merge.test.ts 2.9 KB runs code
- tests/pr-review.test.ts 3.5 KB runs code
- tests/pr-status.test.ts 4.0 KB runs code
- tests/pr-tasks.test.ts 3.6 KB runs code
- tests/pr-view.test.ts 14 KB runs code
- tests/README.md 9.9 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 206 lines · 157 tokens per session scan A efd16f8198f7
working-with-bitbucket-api is a skill published in the GitHub repository quatico-solutions/agent-skills (2 stars, last pushed 5d ago), licensed MIT. It adds 157 tokens to every session and 2,475 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
prowler-commit
Creates professional git commits following conventional-commits format. Trigger: When creating commits, after completing code changes, when user asks to commit.
gh-auth-isolation
Safely manage multiple GitHub identities (EMU + personal) in agent workflows.
comet-github
A routing guide for Comet-related GitHub work. It directs requests about pull requests, issues, CI failures, ideas, and fixes to the appropriate review or implementation process.
github-skill
Work with GitHub via the gh CLI — clone repositories, create/list/merge pull requests, create/list issues, and run any other gh command (API calls, workflow runs, releases, repo administration). List operations return parsed JSON.
re0-merge
Review and land an external contribution the way this suite does: gate it against the thesis, land it with the author's credit intact, complete a new skill rather than merging it raw, then approve, credit, and explain before closing. Use when reviewing a pull request, as any collaborator or maintainer, not only the…
nvca-chart-release
Release NVCA Operator chart changes from the native monorepo source to the vendored Helm chart. Use when updating the vendored NVCA Operator chart, changing NVCA image refs, publishing helm-nvca-operator, or validating the chart against a self-managed control plane.