菜单
Review and manage Dependabot PRs. Categorizes by risk, checks CI status, auto-merges safe updates, and reports issues. Use when the user says "review dependabot", "merge dependabot", "dependabot PRs", or "update dependencies".
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | dependabot-review |
| description | Review and manage Dependabot PRs. Categorizes by risk, checks CI status, auto-merges safe updates, and reports issues. Use when the user says "review dependabot", "merge dependabot", "dependabot PRs", or "update dependencies". |
| license | MIT |
| metadata | {"author":"claude-code-templates","version":"1.0.0"} |
You are a dependency management specialist. Your job is to review all open Dependabot PRs, assess risk, and take action.
List all open Dependabot PRs:
gh pr list --author "dependabot[bot]" --state open --json number,title,labels,createdAt,headRefName --limit 50
If no PRs are found, inform the user and stop.
For each PR, classify it into a risk tier based on the branch name and title:
| Tier | Criteria | Action |
|---|---|---|
| Safe | GitHub Actions updates (dependabot/github_actions/), patch bumps (1.2.3 -> 1.2.4) | Auto-merge |
| Low Risk | Minor bumps (1.2.0 -> 1.3.0) for well-known libraries | Auto-merge after CI check |
| Review Required | Major bumps (1.x -> 2.x), unknown libraries, security-tagged PRs | Report to user |
To determine bump type, parse the PR title. Dependabot titles follow patterns like:
Bump X from 1.2.3 to 1.2.4 (patch)Bump X from 1.2.0 to 1.3.0 (minor)Bump X from 1.0.0 to 2.0.0 (major)For each PR you plan to merge, check CI status:
gh pr checks <number> --json name,state,bucket
For PRs classified as Safe or Low Risk with passing CI:
gh pr merge <number> --merge --delete-branch
Important rules:
After processing, present a summary table to the user:
## Dependabot Review Summary
### Merged (X PRs)
| PR | Update | Type |
|----|--------|------|
| #123 | actions/checkout v4 -> v6 | GitHub Actions |
### Needs Review (X PRs)
| PR | Update | Risk | Reason |
|----|--------|------|--------|
| #456 | jest 29 -> 30 | Major | Breaking changes possible |
### Skipped (X PRs)
| PR | Update | Reason |
|----|--------|--------|
| #789 | chalk 5.5 -> 5.6 | CI failing |
security label or mentions a CVE, always flag it to the user even if it's a patch, so they are awaregh pr list --author "dependabot[bot]" again after each batch to see updated statusQuick safe merge (GitHub Actions only):
The user says "merge the actions PRs" — filter to dependabot/github_actions/ branches only.
Full review: The user says "review dependabot" — run the complete workflow above.
Dry run: The user says "check dependabot" or "show dependabot PRs" — run Steps 1-2 only, report classification without merging.
Audit and incrementally retrofit an existing codebase so its intent and behavior are equally legible to people and AI agents. Applies Context Architecture's eight principles: place AGENTS.md at boundaries, bind every context claim to a mechanism (lint, types, tests, review), name boundaries, and find context that has rotted. Use when an agent reimplements code that already exists, invents structure, follows stale or deleted docs, propagates a deprecated pattern, or resolves ambiguity at random, or when asked to make a repository "agent-ready", "AI-legible", or to add or fix AGENTS.md / CLAUDE.md files.
Use when the user wants to integrate with the X (Twitter) API via Xquik to search tweets, look up user profiles, extract followers, run giveaway draws, monitor accounts, or access trending topics. Also use when the user mentions 'Xquik,' 'Twitter API,' 'X API,' 'tweet scraper,' 'follower extraction,' or 'Twitter monitoring.' Covers REST API, webhooks, and MCP server setup.
Fill any PDF locally and place each value precisely in a visual editor. Use when the user wants to fill out a PDF form, enter data into a PDF, complete a tax/insurance/bank form, or position text on a flat/scanned PDF. Handles flat (field-less) PDFs, per-character (comb) fields, and native AcroForm fields; leaves the signature blank for the user to sign.
Automated Android CI/CD pipeline to Google Play — supports TWA, React Native, Flutter, and native Android. Run npx android-cicd to set up keystore generation, GitHub Secrets, and a multi-stage workflow (internal/alpha/beta/production) with auto-bump versionCode.
Use this skill whenever a developer wants to turn an idea into a complete, production-ready, end-to-end system plan BEFORE writing any code. Trigger on 'plan this system', 'design the architecture for', 'help me blueprint', 'deep plan for X', 'break this idea into components', 'expand into action points', 'full implementation plan', or when the user pastes a project idea wanting architecture, components, pipelines, and file-level execution mapped out. Casual phrasing also triggers: 'help me think this through end-to-end', 'plan before coding'. Also covers living-workspace patterns: self-improving knowledge bases, reflection loops with auditor agents, four-agent teams, schema-as-code, wiki health scoring. **Resume triggers**: 'where did we leave off', 'continue this plan', 'resume my blueprint' - rehydrates state from disk via SESSION.md/NEXT.md/decisions/. Web research is mandatory every invocation.
Use when adding a blog to a Next.js + Sanity site, building a blog section from scratch, integrating Sanity CMS for editorial content, or setting up an SEO-optimized article surface. Triggers on phrases like 'add a blog', 'build the blog', 'create blog section', 'set up blog with Sanity', 'integrate Sanity CMS', 'blog architecture', or any new-blog scoping conversation on a Next.js project.