dependabot-triage SKILL.md skillA
This file is byte-identical to the first copy the registry indexed, one of 3 indexed copies. Same content hash, so the same checks give both the same grade.
dependabot-triage from oleg-koval/agent-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add oleg-koval/agent-skills/dependabot-triage@git:20260828.aaaffd4Pins git:20260828.aaaffd4 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- oleg-koval/agent-skills
- Path
adapters/grok/olko-github-pr/skills/dependabot-triage/SKILL.md- Versions recorded
- 2
- Latest version
- git:20260828.aaaffd4, committed Aug 28, 2026
- First version recorded
- Aug 24, 2026
- Size
- 6,136 bytes
- Repository stars
- 3
- License
- MIT
Triage all open Dependabot and Renovate PRs in bulk: classify each by risk tier (patch / minor / major / security), auto-approve and merge safe patch-only bumps, flag breaking major upgrades with a summary of what changed, and post a digest of what was done. Use when dependency PRs are piling up, when the user says "deal with Dependabot", "triage dependency updates", or "merge the safe ones", or at the start of a maintenance window.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
<!-- Generated by scripts/build-adapters.sh. Do not edit directly. -->
> 🤖 *Auto-generated by **weekly-pattern-learner** · obsidian-pr-sync explicitly filters out dependabot/renovate PRs: the user handles them separately, but no skill existed to batch-triage them*
# Dependabot Triage
Bulk-process open Dependabot and Renovate PRs: approve and merge what is safe,
flag what needs a human decision, and report what was done.
## Inputs
- **Repository** (optional): default to the current repo.
- **Auto-merge policy** (optional, default: `patch-only`): `none`, `patch-only`, or `patch-and-minor`.
- **Require CI** (optional, default: on): only merge PRs whose checks are green.
## Step 1: Fetch all open dependency PRs
```bash
# Dependabot PRs
gh pr list --state open --label "dependencies" \
--json number,title,author,labels,headRefName,url,isDraft \
--jq '.[] | select(.author.login | test("dependabot|renovate"; "i"))'
# Also catch Renovate PRs not labelled "dependencies"
gh pr list --state open \
--json number,title,author,labels,headRefName,url,isDraft \
--jq '.[] | select(.author.login == "renovate[bot]" or .author.login == "dependabot[bot]")'
```
…Read the whole file at its exact version.
How to install
mdr add oleg-koval/agent-skills/dependabot-triage@sha256:59ca4442d4001425The line at the top of this page pins the label git:20260828.aaaffd4, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_xukbqvavl2eggeqp)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Aug 24, 2026 and Aug 28, 2026, about one every 3 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260828.aaaffd4 latest | 2026-08-28 | aaaffd4 | 6,136 B | A | view · diff |
| git:20260824.c71bceb | 2026-08-24 | c71bceb | 6,166 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (6136 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
oleg-koval/agent-skills · 3 stars · license MIT · pushed 2026-10-21 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_xukbqvavl2eggeqp GET https://markdownregistry.com/api/v1/resolve?ref=oleg-koval/agent-skills/dependabot-triage GET https://markdownregistry.com/api/v1/blob/59ca4442d4001425a36ea9181ccb4ac56363b07ca813e32ff23b129b6fced514
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from oleg-koval/agent-skills
Every file in oleg-koval/agent-skills