Dependabot Validator Skill

Analyzes a Dependabot PR's dependency changes against the current project to surface breaking changes, deprecated APIs, and compatibility issues before merging.

Uses only the four core tools (Read, Write, Edit, Bash) plus git and curl. No harness-specific web-search or API tool is required — changelog lookups go through package-registry HTTP APIs via curl, which are deterministic and need no search engine.

Prerequisites

This skill fetches the PR branch with git over your existing remote access — no token or gh CLI needed. GitHub exposes every PR branch at refs/pull/<PR_NUMBER>/head.

Verify remote access works:

git ls-remote origin HEAD

Inputs

• PR number (required). If the user didn't give one, ask: "Which PR or base/head refs should I review?"
• The command runs inside the target repo (current directory).