Dependabot Validator Skill

Analyzes a Dependabot PR's dependency changes against the current project to surface breaking changes, deprecated APIs, and compatibility issues before merging.

See also: USE_CASES.md for trigger phrases and a worked example, and the top-level skills index — use pr-grill-me instead for a general PR review that isn't specifically about dependency compatibility.

Uses only the four core tools (Read, Write, Edit, Bash) plus git and curl. No harness-specific web-search or API tool is required — changelog lookups go through package-registry HTTP APIs via curl, which are deterministic and need no search engine.

Prerequisites

This skill fetches the PR branch with git over your existing remote access — no token or gh CLI needed. GitHub exposes every PR branch at refs/pull/<PR_NUMBER>/head.

Verify remote access works:

git ls-remote origin HEAD

Inputs