matthew-a-carr/triage-dependabot
Repo-aware triage of open Dependabot PRs. Applies this repo's hard-won dependency rules (the Expo-SDK-managed lockstep set, the TS6 / Vite8 holds, dev-only security transitives, the mobile-e2e cache interaction) to recommend merge / hold / close / escalate per PR. Use when a human says "triage the dependabot PRs" or "look at dependabot PR #NNN". Conservative by default: recommends, and only merges green minor/patch PRs when explicitly asked.
84
90%
Does it follow best practices?
Impact
100%
1.17xAverage score across 2 eval scenarios
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
Outsider-authored free text from Dependabot PRs (PR body/changelog excerpts, release notes, CI/check metadata) is read at runtime via `mcp__github__pull_request_read` and placed into the agent’s LLM context for triage.
Where we found it
github.com
domain · 4 sites
The skill instructs the agent to read Dependabot PR data (PR body, changelog excerpts, release notes, CI/check metadata) via mcp__github__pull_request_read, which fetches outsider-authored free text from GitHub and places it into the LLM context for triage analysis.
SKILL.md
48
2. For each, read via `mcp__github__pull_request_read`:
SKILL.md
46
1. List open Dependabot PRs: `mcp__github__list_pull_requests` filtered to the
SKILL.md
132
- Merge: `mcp__github__merge_pull_request` — squash, only when green + a safe
SKILL.md
134
- Close: `mcp__github__update_pull_request` to close, with a comment citing the
- Audited
- Security analysis