CtrlK
BlogDocsLog inGet started
Tessl Logo

addressing-dependabot

Addresses GitHub Dependabot security alerts by listing open alerts, identifying affected Python/uv, frontend npm, and Titus Go projects, upgrading vulnerable dependencies, running verification, and committing fixes. Use when the user wants to fix Dependabot alerts, upgrade vulnerable packages, or address security vulnerabilities found by Dependabot.

91

1.13x
Quality

88%

Does it follow best practices?

Impact

98%

1.13x

Average score across 3 eval scenarios

SecuritybySnyk

Passed

No known issues

SKILL.md
Quality
Evals
Security

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a strong, highly actionable skill with excellent workflow clarity including explicit approval gates, verification checklists, and feedback loops. The content is well-structured and provides concrete, executable commands for all three ecosystems. The main weakness is that the document is quite long and could benefit from better progressive disclosure by splitting ecosystem-specific details into separate files, and some minor redundancy in repeated phrasing.

Suggestions

Consider splitting the ecosystem-specific guidance (Python/npm/Go) in Steps 3-4 into separate reference files to reduce the main skill's length and improve progressive disclosure.

Remove the repeated 'Use request_user_input when available; otherwise ask a direct concise question in chat and wait for an explicit approval response' boilerplate — define it once at the top in the CRITICAL note and reference it at each gate.

DimensionReasoningScore

Conciseness

The skill is fairly long (~300 lines) but most content is actionable and specific to this monorepo's structure. Some sections could be tightened (e.g., the repeated 'Use request_user_input when available; otherwise ask a direct concise question' phrasing appears three times verbatim, and some troubleshooting items repeat guidance already given in earlier steps), but overall it avoids explaining concepts Claude already knows.

2 / 3

Actionability

Excellent actionability throughout — every step includes concrete, executable bash commands with proper variable substitution patterns, specific file paths, and exact tool invocations. The npm override JSON pattern, uv commands, go get commands, and gh API calls are all copy-paste ready with clear placeholders.

3 / 3

Workflow Clarity

The workflow is clearly sequenced with numbered steps, two explicit approval gates, a verification checklist, and a feedback loop for test/lint failures. The error recovery path (investigate → fix → re-run) and the final commit scope are well-defined. The distinction between direct and transitive dependencies is handled with clear branching logic.

3 / 3

Progressive Disclosure

The content is well-structured with clear headers and logical sections, but it's a monolithic document with no references to supporting files. Given the length and complexity (covering three ecosystems with multiple sub-cases each), the ecosystem-specific sections (Python, npm, Go) could benefit from being split into separate reference files. However, since no bundle files are provided, the inline approach is the only option and is reasonably organized.

2 / 3

Total

10

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is an excellent skill description that clearly articulates specific capabilities across multiple ecosystems, includes natural trigger terms users would use, and provides explicit 'Use when' guidance. It is well-scoped to the Dependabot security alert domain, making it highly distinguishable from other skills.

DimensionReasoningScore

Specificity

Lists multiple specific concrete actions: listing open alerts, identifying affected projects across specific ecosystems (Python/uv, npm, Go), upgrading vulnerable dependencies, running verification, and committing fixes.

3 / 3

Completeness

Clearly answers both 'what' (listing alerts, identifying affected projects, upgrading dependencies, running verification, committing fixes) and 'when' with an explicit 'Use when...' clause covering three trigger scenarios.

3 / 3

Trigger Term Quality

Includes strong natural trigger terms users would say: 'Dependabot alerts', 'security alerts', 'vulnerable packages', 'security vulnerabilities', 'fix Dependabot alerts', 'upgrade vulnerable packages'. Also mentions specific ecosystems (Python, npm, Go) which users might reference.

3 / 3

Distinctiveness Conflict Risk

Highly distinctive with clear niche: specifically targets GitHub Dependabot security alerts, which is a well-defined domain unlikely to conflict with general dependency management or generic security skills. The mention of specific ecosystems and Dependabot further narrows the scope.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation11 / 11 Passed

Validation for skill structure

No warnings or errors.

Repository
SpecterOps/Nemesis
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.