CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

merge-dependency-updates

Review and merge open bot PRs: dependency updates from dotnet-maestro, codeflow from dotnet/dotnet, and OneLoc localization PRs. Produces a clickable dashboard with CI status, review state, and suspicious file flags. Use when you want to triage all open bot PRs in one pass.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured operational guide whose queries, commands, and detection tables are directly executable. Its weaknesses are modest: no post-update verification step in the batch workflow, and time-sensitive version thresholds embedded in the procedure rather than isolated.

Suggestions

Add a verification checkpoint after Step 3 (e.g., re-check CI status and confirm the push landed before marking a PR merge-ready) to close the batch-operation feedback loop.

Move the version-number thresholds (vs18.10 cutoff, branch/version table) into a clearly labeled reference or 'current branch policy' section so they are easy to update as branches age.

Consider splitting the full GraphQL query into a referenced file to keep SKILL.md as a lean overview, since no bundle files currently exist.

DimensionReasoningScore

Conciseness

The body is dense and operational — exact title patterns, expected file paths, executable commands, and a dashboard format — with no padding or explanations of concepts Claude already knows. It falls short of anchor 5 only because time-sensitive version numbers ("Skip for vs18.10 and newer vs* branches", "<VersionPrefix>18.3.3</VersionPrefix>") are embedded in the main procedure rather than isolated, per the guideline penalizing version-number content outside a deprecated/old-patterns section.

4 / 5

Actionability

Every step is copy-paste ready: complete `gh api graphql` query and `updatePullRequestBranch` mutation bodies, exact git commands for the version bump, concrete author/title search strings, and explicit file-pattern tables for suspicious detection. Matches anchor 5 ("fully executable; copy-paste ready code or commands; specific examples cover the common cases"); the only placeholders (<PR_NUMBER>, <NODE_ID>) are necessary parameterization, not pseudocode.

5 / 5

Workflow Clarity

Steps 1–4 are clearly sequenced with parallelization guidance, and validation checkpoints exist (CI statusCheckRollup extraction, suspicious file detection, review decision) plus a troubleshooting table with retry/recovery paths ("Push rejected... re-fetch and retry", "updatePullRequestBranch fails... fall back to local git merge"). It stays at anchor 4 rather than 5 because there is no verification after the mutating step 3 — no instruction to confirm the push succeeded or re-check CI after updating a branch/bumping the version before declaring merge readiness — a minor validation gap in a batch workflow.

4 / 5

Progressive Disclosure

No bundle files exist (no references/, scripts/, or assets/), and the ~195-line body is well organized into clear sections with tables and code blocks, all of which is core operational content. It matches anchor 4 ("good structure; most content is appropriately placed; minor organization gaps"): the dashboard example and Version File Reference table could arguably move to reference files, keeping SKILL.md leaner, but nothing is buried or misfiled.

4 / 5

Total

17

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that concretely states what it does and when to use it with a clear, distinctive niche. Its main flaws are the second-person trigger clause (which costs specificity under the rubric) and missing trigger synonyms such as "pull request".

Suggestions

Rewrite the trigger clause in third person to avoid the specificity penalty, e.g. "Use it when the user wants to triage all open bot PRs in one pass."

Add the branch-update and version-bump actions to the "what" list so the description covers everything the skill actually does.

Include a few natural trigger variations such as "pull requests", "localization PRs", or "arcade/roslyn updates" to broaden keyword coverage.

DimensionReasoningScore

Specificity

"Review and merge open bot PRs: dependency updates from dotnet-maestro, codeflow from dotnet/dotnet, and OneLoc localization PRs" plus "Produces a clickable dashboard with CI status, review state, and suspicious file flags" lists multiple specific concrete actions with comprehensive coverage, which matches the anchor-5 example. However, the second-person phrasing "Use when you want to triage" triggers the mandated 1-point penalty, landing it at anchor 4 ("lists several specific actions; minor gaps"), which also fits the fact that it omits the branch-update/version-bump actions the skill performs.

4 / 5

Completeness

The description explicitly answers both questions: the "what" ("Review and merge open bot PRs... Produces a clickable dashboard with CI status, review state, and suspicious file flags") and a concrete "when" ("Use when you want to triage all open bot PRs in one pass"). This directly matches anchor 5 ("clearly and explicitly answers both what AND when with concrete trigger phrases"), and anchor 4's caveat ("'when' could be more explicit") does not apply since the trigger clause is already specific.

5 / 5

Trigger Term Quality

Natural terms a maintainer would say are present — "open bot PRs", "dependency updates", "OneLoc localization PRs", "triage", "merge" — but common variations like "pull request", "localization", and the specific update sources (arcade, roslyn) are absent. It sits between anchor 4 ("good keyword coverage; a few natural terms missing") and anchor 5 (comprehensive synonyms/extensions), closer to 4 since only one phrasing of each trigger exists.

4 / 5

Distinctiveness Conflict Risk

Named bots (dotnet-maestro, dotnet-bot), the dotnet/dotnet codeflow source, and OneLoc localization terminology create a clear niche with distinct triggers and minimal conflict risk with generic PR-review skills. Matches anchor 5; anchor 4's "minor overlap risk" is not warranted since the trigger vocabulary is unique to this repo's bot workflow.

5 / 5

Total

18

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

dotnet/msbuild

Path

.github/skills/merge-dependency-updates/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.