The Agent Skills Directory

[SAFE]: The skill primarily consists of instructional documentation and YAML templates. It guides the agent on how to structure a .github/dependabot.yml file according to specific conventions (e.g., weekly updates, consistent quoting, and grouping). No suspicious network operations, obfuscation, or unauthorized access patterns are present.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read manifest files and existing configurations from the local repository, which is a potential surface for indirect prompt injection if those files contain malicious instructions.
Ingestion points: Reads manifest files including package.json, composer.json, Dockerfile, docker-compose.yml, requirements.txt, pyproject.toml, uv.lock, go.mod, and .github/workflows/ using the Glob, Grep, and Read tools.
Boundary markers: None present; the skill does not explicitly instruct the agent to ignore or delimit instructions found within these files.
Capability inventory: The skill utilizes Read, Write, Edit, Glob, Grep, and Bash for file system analysis and modification.
Sanitization: None present; the content of the manifest files is used to determine project structure without explicit sanitization steps.

dependabot-config