The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill and its associated reference documentation (references/dependabot-advanced.md) recommend the use of the dependabot/fetch-metadata GitHub Action. This is a well-known, official utility from GitHub used to extract metadata from Dependabot-generated pull requests.
[COMMAND_EXECUTION]: The skill provides example GitHub Action workflows that utilize the GitHub CLI (gh pr merge) for automation. These examples are designed with security in mind, utilizing flags like --auto to ensure repository checks are satisfied and targeting only the dependabot[bot] actor to prevent unauthorized triggers.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a reference for reviewing external configuration files, creating a surface for processing untrusted data.
Ingestion points: The agent reads and interprets .github/dependabot.yml files during review or authoring tasks.
Boundary markers: The skill relies on the structured nature of YAML configuration and emphasizes the use of explicit justification comments for security waivers.
Capability inventory: The skill documents automation via GitHub Actions (PR merging) but does not perform direct file system or network operations.
Sanitization: The instructions guide the agent to perform strict logical validation of configuration values, such as identifying incorrect ecosystem identifiers or unsafe version ranges that accidentally bypass security patches.

dependabot-config