메뉴
Merge Dependabot PRs, update dependencies, handle dependency updates. Use when Dependabot PRs are pending, need to review dependency bumps, or update packages safely.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Analyze unresolved PR review comments and recommend whether to fix, skip, or optionally address each. Use when a PR has review comments and you need a verdict on how to respond.
Create a git commit. Use when ready to commit changes. Creates conventional commit messages focused on why, not what.
Open a pull request for the current branch. Use when code is ready for review. Creates concise descriptions focused on the problem being solved.
Karpman Drama Triangle analysis for communication and conflict. Use when reviewing emails, proposals, or scripts for hidden drama dynamics, coaching difficult conversations, analyzing interpersonal conflict, or reframing victim/hero/villain patterns into Creator/Challenger/Coach alternatives.
Audit codebase, assess technical debt, analyze architecture, find structural problems. Use when evaluating code health, planning refactors, or need architectural review. Covers brittleness, coupling, complexity.
Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics.
| name | review-dependabot |
| description | Merge Dependabot PRs, update dependencies, handle dependency updates. Use when Dependabot PRs are pending, need to review dependency bumps, or update packages safely. |
| context | fork |
Analyze open Dependabot PRs and merge safe updates.
Single repo:
gh pr list --author app/dependabot --state open --json number,title,body,url,statusCheckRollup,files
Multi-repo (when user mentions "all repos", specifies an owner, or cwd has no git repo):
gh search prs --author app/dependabot --owner {owner} --state open --json repository,number,title,url
For each repo, check ~/Repos/ for existing clone or clone to /tmp/dependabot-review/{repo-name}, then fetch full details with gh pr view.
PRs mergeable immediately (CI passing, status MERGEABLE):
1.2.3 → 1.2.4) - bug fixes only@types/* packages - type definitions, no runtime codePRs modifying .github/workflows/* require the workflow OAuth scope (unavailable to gh CLI). Check the files field, present GitHub URLs, and let the user merge via browser.
Major bumps (3.x → 4.x), runtime dependencies, and framework updates warrant deeper analysis. Spawn general-purpose agents in parallel:
Evaluate {name} {old} → {new} for {repo}:
1. Search for "{name} v{new_major} migration guide"
2. Extract breaking changes from PR body (release notes)
3. Search codebase for usage: `rg "{name}"`
4. Assess impact on found usages
Response: Confidence (0-100%), breaking changes, migration URL, recommendation (merge/review/skip), one-sentence reason.
CONFLICTING) - needs Dependabot rebaseGroup PRs by category with tables. Formatting notes:
Use AskUserQuestion: (1) Merge all safe PRs, (2) Include manual-merge PRs (opens browser tabs), (3) Select individually, (4) Cancel.
gh pr merge {number} --squash
Lockfile conflicts: Merge PRs sequentially per repo. When a merge fails with "not mergeable", comment @dependabot rebase and inform the user.
Workflow file errors ("refusing to allow an OAuth App to create or update workflow"): Move to Manual Merge Required list with GitHub URL.
Map title and body patterns to the categories above:
| Pattern | Category |
|---|---|
Bump @types/ | Safe to Merge |
security or CVE- in body | Safe to Merge |
Bump actions/ | Manual Merge Required |
group in title | Needs Review |
x.0.0 in version | Needs Review |