check-dependabot SKILL.md skillA
check-dependabot from sergeyklay/.agents is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add sergeyklay/.agents/check-dependabot@v1.0Pins v1.0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- sergeyklay/.agents
- Path
.agents/skills/check-dependabot/SKILL.md- Versions recorded
- 1
- Latest version
- v1.0, committed Sep 3, 2026
- Size
- 10,830 bytes
- Repository stars
- 6
- License
- Apache-2.0
Validate a Dependabot configuration against the published JSON Schema and audit its groups against the repository's real dependency manifests. Use when creating or rewriting .github/dependabot.yml, when adding or reorganising `groups`, `ignore` or `exclude-patterns`, when a dependency lands in the wrong grouped PR or keeps arriving as an individual PR, when Dependabot stops opening PRs after a config edit, or when reviewing a PR that touches dependabot.yml. Catches keys the schema rejects…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Validating a Dependabot configuration A `dependabot.yml` fails in two independent ways, and each needs its own check. **Syntactically**, a misspelled key or an unsupported enum value makes GitHub reject the file. Dependabot reports this only under Insights → Dependency graph → Dependabot, so the usual symptom is silence: no PRs, no CI failure, nothing in the pull request list. **Semantically**, the file is valid and Dependabot runs it happily, but it does not do what the author meant. A `patterns` entry naming a package the repo never installed groups nothing. An `ignore` entry for a package that was renamed or removed protects nothing. A package matched by two groups lands in whichever one Dependabot picks, not the one the comment above it claims. None of this surfaces until a PR arrives in the wrong shape, weeks later. Schema validation catches the first class and is blind to the second. Run both. ## Running scripts bundled with this skill Script paths resolve relative to **this** SKILL.md, not the agent's CWD. If a relative command fails to resolve, prefix it with the directory the platform loaded SKILL.md from. …
Read the whole file at its exact version.
How to install
mdr add sergeyklay/.agents/check-dependabot@sha256:af82c8ca535a3aeaThe line at the top of this page pins the label v1.0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_quitdejrmea4npce)
5 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 3, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (10830 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
sergeyklay/.agents · 6 stars · license Apache-2.0 · pushed 2026-10-16 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_quitdejrmea4npce GET https://markdownregistry.com/api/v1/resolve?ref=sergeyklay/.agents/check-dependabot GET https://markdownregistry.com/api/v1/blob/af82c8ca535a3aeaeea157f87d3c79a2b3b7cdf594b79f8e4fc05947b8ebcdfb
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.