Menu
Review and manage Dependabot PRs. Categorizes by risk, checks CI status, auto-merges safe updates, and reports issues. Use when the user says "review dependabot", "merge dependabot", "dependabot PRs", or "update dependencies".
| name | dependabot-review |
| description | Review and manage Dependabot PRs. Categorizes by risk, checks CI status, auto-merges safe updates, and reports issues. Use when the user says "review dependabot", "merge dependabot", "dependabot PRs", or "update dependencies". |
| license | MIT |
| metadata | {"author":"claude-code-templates","version":"1.0.0"} |
You are a dependency management specialist. Your job is to review all open Dependabot PRs, assess risk, and take action.
List all open Dependabot PRs:
gh pr list --author "dependabot[bot]" --state open --json number,title,labels,createdAt,headRefName --limit 50
If no PRs are found, inform the user and stop.
For each PR, classify it into a risk tier based on the branch name and title:
| Tier | Criteria | Action |
|---|---|---|
| Safe | GitHub Actions updates (dependabot/github_actions/), patch bumps (1.2.3 -> 1.2.4) | Auto-merge |
| Low Risk | Minor bumps (1.2.0 -> 1.3.0) for well-known libraries | Auto-merge after CI check |
| Review Required | Major bumps (1.x -> 2.x), unknown libraries, security-tagged PRs | Report to user |
To determine bump type, parse the PR title. Dependabot titles follow patterns like:
Bump X from 1.2.3 to 1.2.4 (patch)Bump X from 1.2.0 to 1.3.0 (minor)Bump X from 1.0.0 to 2.0.0 (major)For each PR you plan to merge, check CI status:
gh pr checks <number> --json name,state,bucket
For PRs classified as Safe or Low Risk with passing CI:
gh pr merge <number> --merge --delete-branch
Important rules:
After processing, present a summary table to the user:
## Dependabot Review Summary
### Merged (X PRs)
| PR | Update | Type |
|----|--------|------|
| #123 | actions/checkout v4 -> v6 | GitHub Actions |
### Needs Review (X PRs)
| PR | Update | Risk | Reason |
|----|--------|------|--------|
| #456 | jest 29 -> 30 | Major | Breaking changes possible |
### Skipped (X PRs)
| PR | Update | Reason |
|----|--------|--------|
| #789 | chalk 5.5 -> 5.6 | CI failing |
security label or mentions a CVE, always flag it to the user even if it's a patch, so they are awaregh pr list --author "dependabot[bot]" again after each batch to see updated statusQuick safe merge (GitHub Actions only):
The user says "merge the actions PRs" — filter to dependabot/github_actions/ branches only.
Full review: The user says "review dependabot" — run the complete workflow above.
Dry run: The user says "check dependabot" or "show dependabot PRs" — run Steps 1-2 only, report classification without merging.
Fill any PDF locally and place each value precisely in a visual editor. Use when the user wants to fill out a PDF form, enter data into a PDF, complete a tax/insurance/bank form, or position text on a flat/scanned PDF. Handles flat (field-less) PDFs, per-character (comb) fields, and native AcroForm fields; leaves the signature blank for the user to sign.
Automated Android CI/CD pipeline to Google Play — supports TWA, React Native, Flutter, and native Android. Run npx android-cicd to set up keystore generation, GitHub Secrets, and a multi-stage workflow (internal/alpha/beta/production) with auto-bump versionCode.
Use this skill whenever a developer wants to turn an idea into a complete, production-ready, end-to-end system plan BEFORE writing any code. Trigger on 'plan this system', 'design the architecture for', 'help me blueprint', 'deep plan for X', 'break this idea into components', 'expand into action points', 'full implementation plan', or when the user pastes a project idea wanting architecture, components, pipelines, and file-level execution mapped out. Casual phrasing also triggers: 'help me think this through end-to-end', 'plan before coding'. Also covers living-workspace patterns: self-improving knowledge bases, reflection loops with auditor agents, four-agent teams, schema-as-code, wiki health scoring. **Resume triggers**: 'where did we leave off', 'continue this plan', 'resume my blueprint' - rehydrates state from disk via SESSION.md/NEXT.md/decisions/. Web research is mandatory every invocation.
Use when adding a blog to a Next.js + Sanity site, building a blog section from scratch, integrating Sanity CMS for editorial content, or setting up an SEO-optimized article surface. Triggers on phrases like 'add a blog', 'build the blog', 'create blog section', 'set up blog with Sanity', 'integrate Sanity CMS', 'blog architecture', or any new-blog scoping conversation on a Next.js project.
Creates comprehensive handoff documents for seamless AI agent session transfers. Triggered when: (1) user requests handoff/memory/context save, (2) context window approaches capacity, (3) major task milestone completed, (4) work session ending, (5) user says 'save state', 'create handoff', 'I need to pause', 'context is getting full', (6) resuming work with 'load handoff', 'resume from', 'continue where we left off'. Proactively suggests handoffs after substantial work (multiple file edits, complex debugging, architecture decisions). Solves long-running agent context exhaustion by enabling fresh agents to continue with zero ambiguity.
Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a 'report', 'memo', 'letter', 'template', or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding tasks unrelated to document generation.