dependabot-review

Topics in the source

• User context
• Process
• 1. Preflight
• 2. List the PRs
• 3. Build recipe
• 4. Fan out
• 5. Verdicts
• 6. Report

Read-only verdict on each open Dependabot PR on two axes: Build — does the PR break install, build, lint/typecheck or tests, compared to the base branch? Behaviour — could the version change alter what the software does at runtime, given how this repo uses the package? The skill reports. Merging, closing, approving, commenting and pushing are the user's call. $ARGUMENTS is free text. Read it as two kinds of input: Filters — label, ecosystem, directory, PR numbers, "majors only". Apply them in step 2. Context — facts about the repo or the team ("we pin X on purpose", "TS majors are always blocked"). Pass it verbatim into every subagent prompt. No arguments = all open Dependabot PRs, no extra context. Run gh repo view --json nameWithOwner,defaultBranchRef. If it fails (no GitHub remote, gh not authenticated), stop and tell the user which. Read the repo's agent instructions (CLAUDE.md, AGENTS.md, memory) for known dependency facts — blocked upgrades, broken test setups, build quirks. These count as context too. Done when: you have the repo, its default branch, and its dependency facts. Apply the filters. Also include PRs from dependabot-preview[bot] or with branch prefix dependabot/ i

This is an excerpt. Refer to the complete source and its current requirements.