harnessprotocol/harness-kit · plugins/dependabot-sweep/skills/dependabot-sweep/SKILL.md
dependabot-sweep skillA
Use when the user wants to fix, address, clear, or resolve open Dependabot security/vulnerability alerts for a repository, end to end. Fetches open alerts via the gh CLI, fixes them per ecosystem (pnpm/npm overrides + lockfile regen, cargo update, pip/go/bundler), verifies with audit and frozen-lockfile installs, then branches → commits → pushes → opens a PR, and squash-merges once CI is green — escalating only when a fix carries breaking-change risk or can't be resolved. Trigger on "/dependabot
Latest version
mdr add harnessprotocol/harness-kit/dependabot-sweep@git:20260727.f61816cExact content
mdr add harnessprotocol/harness-kit/dependabot-sweep@sha256:1921f4edc5574066Badge
[](https://markdownregistry.com/a/art_voqxjlp5g5nc5lma)
0 badge views in 30 days
Versions
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260727.f61816c latest | 2026-07-27 | f61816c | 9,474 B | A | view · diff |
| git:20260605.7db7525 | 2026-06-05 | 7db7525 | 9,282 B | A | view |
Audit of the latest version
A 17 of 17 checks passed. Deterministic, no model, same answer every run.
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (9474 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
GitHub
harnessprotocol/harness-kit · 10 stars · license Apache-2.0 · pushed 2026-09-04 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_voqxjlp5g5nc5lma GET https://markdownregistry.com/api/v1/resolve?ref=harnessprotocol/harness-kit/dependabot-sweep GET https://markdownregistry.com/api/v1/blob/1921f4edc55740664a2b83793e41bc875c9df9c206d55b1a2c01fe07acb7936f