CtrlK
BlogDocsLog inGet started
Tessl Logo

addressing-dependabot

Addresses GitHub Dependabot security alerts by listing open alerts, identifying affected Python/uv, frontend npm, and Titus Go projects, upgrading vulnerable dependencies, running verification, and committing fixes. Use when the user wants to fix Dependabot alerts, upgrade vulnerable packages, or address security vulnerabilities found by Dependabot.

93

1.13x
Quality

90%

Does it follow best practices?

Impact

98%

1.13x

Average score across 3 eval scenarios

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable commands, clear gating, verification, and feedback loops across all three ecosystems. Minor conciseness and disclosure gains come from trimming troubleshooting duplication and externalizing the project-path reference.

Suggestions

De-duplicate the troubleshooting section against Steps 3-4 to reduce redundancy and token cost.

Move the static project-path reference list into a bundled reference file so the main flow stays lean.

Trim repeated ecosystem explanations that restate Step 4 commands in the troubleshooting section.

DimensionReasoningScore

Conciseness

Mostly efficient with executable commands and minimal concept explanation, but the troubleshooting section repeats guidance already in Steps 3-4 (overrides, constraint-dependencies, go path) and the project path reference could be trimmed.

4 / 5

Actionability

Provides copy-paste ready commands for every ecosystem and direct/transitive case, with concrete verification commands (npm ls, go list -m, uv run pytest) and explicit commit-file lists.

5 / 5

Workflow Clarity

Clear six-step sequence with two explicit approval gates, a verification checklist, and a feedback loop (investigate failure, fix, re-run) for batch/destructive dependency operations.

5 / 5

Progressive Disclosure

Well-organized into sequenced steps and a troubleshooting section with no bundle files (single-file skill), but the inlined project-path reference list and troubleshooting duplication are content that could live in a separate reference file.

4 / 5

Total

18

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and clearly distinct, covering concrete remediation actions and explicit usage triggers. Trigger term coverage is strong but slightly repetitive and could add synonyms like 'CVE'.

Suggestions

Add synonyms such as 'CVE' or 'security advisory' to broaden natural trigger matching.

Vary phrasing beyond repeating 'Dependabot' to capture users who say 'security alerts' or 'vulnerable dependencies'.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'listing open alerts', 'identifying affected Python/uv, frontend npm, and Titus Go projects', 'upgrading vulnerable dependencies', 'running verification', and 'committing fixes' — with comprehensive coverage of the remediation flow.

5 / 5

Completeness

Explicitly answers both 'what' (the full remediation sequence) and 'when' via a clear 'Use when the user wants to fix Dependabot alerts, upgrade vulnerable packages, or address security vulnerabilities found by Dependabot.' clause with concrete trigger phrases.

5 / 5

Trigger Term Quality

Includes natural triggers ('fix Dependabot alerts', 'upgrade vulnerable packages', 'address security vulnerabilities found by Dependabot'), but misses common synonyms like 'CVE' or 'security advisory' and repeats 'Dependabot' rather than varying phrasing.

4 / 5

Distinctiveness Conflict Risk

Targets a clear niche (Dependabot alert remediation in a specific multi-ecosystem monorepo) with distinct triggers; minimal risk of conflicting with other skills.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
SpecterOps/Nemesis
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.