While monitoring edits made on Wikidata with the Wikidata Bridge, we noticed that the Wikidata Bridge tag can be added to edits that don't seem to have anything to do with the Bridge, like this one.
Questions:
is it possible for people to add the Wikidata Bridge tag manually tag to any edit?
Yes, and also to any log entry. This is because it’s a user-defined tag, and not an extension-defined tag.
if so, do we want to prevent this, and how?
I don’t think there’s a good way for us to prevent this – the Wikidata Bridge JavaScript running on the client wiki is not inherently any more trusted than other JavaScript (gadgets, user scripts), there’s no way for the repo wiki to tell whether an API call came from the Data Bridge or from some other source. We could probably register some code in Wikibase Repo to only allow applying the tag on entity pages, or only with the wbeditentity API action, or something similar, but I feel like that will only make abuse of the tag harder to detect – at least at the moment, it’s fairly easy to identify that talk page edit as spam.
is it technically possible that someone would use the Bridge feature for other purposes (eg create a new item or add a message on a talk page)?
I don’t see how, no.
There is desire to easily create items, similar to page forms (from an editor perspective this is great) or Wikidata Cradle, but that's a different issue (probably T205014, see also T228603,T242428).
Note that since T303682: Requested wiki configuration change: remove changetags right from users on wikidatawiki, it’s at least no longer possible to apply the Wikidata Bridge tag to edits or logged actions after the fact; it can only be added by the person performing the action now, at the time that they make the API request.