skills

Review and batch-merge open Dependabot pull requests. Only invoke explicitly with /dependabot-review. Lists all open Dependabot PRs, analyzes each for security and compatibility concerns, presents a plan with approval comments, then approves and merges safe PRs on user confirmation.

Plan implementation for a GitHub issue. Use this skill whenever the user pastes a GitHub issue URL (e.g., https://github.com/org/repo/issues/123), mentions a GitHub issue number in the context of a repo, or asks to plan work for a bug, PBI, or feature tracked in GitHub Issues. Also trigger when the user says things like 'plan this issue', 'look at this bug', or provides a GitHub link with minimal other instructions — the intent is almost always 'fetch the issue, understand the codebase, and give me a plan'. Even a bare URL with no other text should trigger this skill.

Review and remediate GitHub security alerts (Dependabot, code scanning, secret scanning). Only invoke explicitly with /github-security-alerts. Analyzes open alerts, categorizes as fix or dismiss with reasoning, groups fixes into issues sized for independent agent work, and handles public repo safety.

Evidence-backed pull request review. Use when the user gives a PR URL, branch, or diff range and asks to validate it works, find concerns/risks, sanity-check an implementation, or decide whether it's safe to approve — especially when they supply a brief to validate against. Inspects the live PR via gh, reads the surrounding code, runs targeted validation, and produces a durable branded HTML artifact plus a concise findings summary. Do not use for fixing PR review comments (use pr-resolve-comments) or autopilot merge flows (use pr-autopilot) unless explicitly asked.