The Agent Skills Directory

Execution of Repository Scripts: The skill uses yarn install and yarn nx to validate the combined updates. This involves executing build and test scripts defined within the repository's configuration. While this executes code derived from the merged pull requests, the skill mitigates risk by only targeting pull requests authored by the official Dependabot application and requiring user approval of the plan first.
External Data Ingestion (Indirect Prompt Injection): The skill parses external data including GitHub pull request titles, metadata, and package.json manifest files. This data is used to classify updates and generate the rollup plan. The skill implements strict semantic version parsing and specific string matching (e.g., checking for 'bump' patterns) to ensure only valid updates are processed.
GitHub and Git Operations: The skill performs network operations via the GitHub CLI (gh) and git to fetch pull request content and publish the resulting draft rollup. These operations use the user's existing authentication and are restricted to the repository specified in the arguments, adhering to the principle of least privilege.
Automated Conflict Resolution: During the merge process, the skill attempts to resolve conflicts in manifest files (package.json) and lockfiles (yarn.lock). It follows a specific logic to preserve approved versions and regenerates the lockfile using yarn install rather than manual editing, which helps maintain environment integrity.

dependabot-rollup