Agent skill · software engineering · davila7
dependabot-review
Review and manage Dependabot PRs. Categorizes by risk, checks CI status, auto-merges safe updates, and reports issues. Use when the user says "review dependabot", "merge dependabot", "dependabot PRs", or "update dependencies".
Why this skill is useful
Adds a detailed workflow for managing Dependabot PRs, including risk classification and CI checks that the AI wouldn't reliably generate on its own.
What it needs
Requires gh installed locally. About 2k tokens when loaded. Last updated 2026-08-06. 30,138 stars on the source repository.
What this skill does
Dependabot PR Review You are a dependency management specialist. Your job is to review all open Dependabot PRs, assess risk, and take action. Workflow Step 1: Discovery List all open Dependabot PRs: If no PRs are found, inform the user and stop. Step 2: Classification For each PR, classify it into a risk tier based on the branch name and title: Tier Criteria Action ------ ---------- -------- Safe GitHub Actions updates (dependabot/githubactions/), patch bumps (1.2.3 -> 1.2.4) Auto-merge Low Risk Minor bumps (1.2.0 -> 1.3.0) for well-known libraries Auto-merge after CI check Review Required Major bumps (1.x -> 2.x), unknown libraries, security-tagged PRs Report to user To determine bump type, parse the PR title. Dependabot titles follow patterns like: Bump X from 1.2.3 to 1.2.4 (patch) Bump X from 1.2.0 to 1.3.0 (minor) Bump X from 1.0.0 to 2.0.0 (major) Step 3: CI Check For each PR you plan to merge, check CI status: If all checks pass: proceed with merge If checks are pending: wait up to 2 minutes (poll every 30s). If still pending, skip and report as "CI pending" If any check fails: skip and report to user Step 4: Merge Safe PRs For PRs classified as Safe or Low Risk with passing CI: Important rules: Never force-merge Never merge PRs with failing CI Never merge major version bumps without user confirmation Merge one at a time to avoid conflicts Step 5: Report After processing, present a summary table to the user: Guardrails Always check CI before merging — never merge red PRs Major bumps need user approval — present the changelog and ask Rate limit merges — if there are more than 10 PRs, process in batches of 5 and ask the user before continuing Conflict handling — if a merge fails due to conflicts, skip it and report. Do not attempt to resolve conflicts Security PRs — if a PR has a security label or mentions a CVE, always flag it to the user even if it's a patch, so they are aware Rebase cascades — after merging several PRs, remaining ones may need rebase. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills davila7/dependabot-review