CtrlK
BlogDocsLog inGet started
Tessl Logo

matthew-a-carr/triage-dependabot

Repo-aware triage of open Dependabot PRs. Applies this repo's hard-won dependency rules (the Expo-SDK-managed lockstep set, the TS6 / Vite8 holds, dev-only security transitives, the mobile-e2e cache interaction) to recommend merge / hold / close / escalate per PR. Use when a human says "triage the dependabot PRs" or "look at dependabot PR #NNN". Conservative by default: recommends, and only merges green minor/patch PRs when explicitly asked.

84

1.17x
Quality

90%

Does it follow best practices?

Impact

100%

1.17x

Average score across 2 eval scenarios

SecuritybySnyk

Advisory

Suggest reviewing before use

Overview
Quality
Evals
Security
Files

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a strong, highly actionable skill that encodes complex repo-specific dependency rules into a clear, sequenced workflow. Its greatest strength is the specificity of its rules — exact package families, version directions, issue references, and tool invocations — combined with conservative safety defaults. Minor weaknesses include some verbosity in framing sections and the monolithic structure that could benefit from splitting detailed rules into a reference file.

Suggestions

Trim the 'When to use' section — the first paragraph explains motivation Claude doesn't need; the second paragraph with usage examples is sufficient.

Consider extracting the version-locked families list and ecosystem-readiness pins into a separate reference file (e.g., DEPENDENCY_RULES.md) to improve progressive disclosure and make the main skill leaner.

DimensionReasoningScore

Conciseness

The skill is mostly efficient and repo-specific, but the 'When to use' section repeats context that could be trimmed, and the 'Untrusted content' block, while important, is somewhat verbose. The detailed rule explanations earn their place given the complexity, but some phrasing could be tightened.

2 / 3

Actionability

Highly actionable: specifies exact MCP tool names, exact package families with version directions, exact CI failure diagnosis heuristics, and provides a concrete output table format. The merge/close commands include specific flags and constraints. Every rule is tied to a concrete action.

3 / 3

Workflow Clarity

Clear 4-step sequence (Gather → Apply rules → Report → Act) with explicit validation checkpoints: CI must be green before merge, version-lock checks before any action, and a 'Do not' section as a final guardrail. The feedback loop for red CI (suspect TD-009 mechanisms first) and the explicit 'only on explicit instruction' gate for destructive actions are well-designed.

3 / 3

Progressive Disclosure

The skill references external files (docs/tech-debt.md, .github/dependabot.yml, AGENTS.md) appropriately, but all content is inline in a single file with no bundle files to offload detail into. The version-locked families table and security rules could potentially be split into a reference file, though for a standalone skill this is acceptable. No bundle files are provided to support progressive disclosure.

2 / 3

Total

10

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is an excellent skill description that clearly defines a narrow, well-scoped task (Dependabot PR triage) with specific actions (merge/hold/close/escalate), explicit trigger phrases, and detailed context about the repo-specific rules it applies. It uses third person voice throughout and provides enough detail for Claude to confidently select this skill only when appropriate. The conservative-by-default caveat adds useful behavioral context.

DimensionReasoningScore

Specificity

Lists multiple specific concrete actions: triage open Dependabot PRs, apply dependency rules (with named examples like Expo-SDK-managed lockstep, TS6/Vite8 holds, dev-only security transitives, mobile-e2e cache interaction), recommend merge/hold/close/escalate per PR, and only merges green minor/patch PRs when explicitly asked.

3 / 3

Completeness

Clearly answers both 'what' (repo-aware triage of Dependabot PRs applying specific dependency rules to recommend actions) and 'when' (explicit 'Use when' clause with concrete trigger phrases like 'triage the dependabot PRs' or 'look at dependabot PR #NNN').

3 / 3

Trigger Term Quality

Includes highly natural trigger terms that users would actually say: 'triage the dependabot PRs', 'look at dependabot PR #NNN', 'dependabot', 'merge', 'dependency'. These are realistic phrases a developer would use.

3 / 3

Distinctiveness Conflict Risk

Extremely distinctive niche: specifically targets Dependabot PR triage with repo-specific dependency rules. The named constraints (Expo-SDK lockstep, TS6/Vite8 holds) and the specific trigger phrases make it very unlikely to conflict with other skills like general PR review or dependency management.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation11 / 11 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents