CtrlK
BlogDocsLog inGet started
Tessl Logo

sq-actions-dependabot

Reviews and merges Dependabot pull requests for GitHub Actions (the github-actions ecosystem) that bump `uses:` pins in `.github/workflows/`. Use for Dependabot github_actions PRs (branches like `dependabot/github_actions/...`), not go.mod or site/ Bun PRs.

76

Quality

95%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

96%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is an exemplar of a maintainer workflow skill: executable commands, a phased sequence with real validation checkpoints and feedback loops, and lean prose that assumes competence. The only minor gap is progressive disclosure, which is bounded by the absence of any bundle files to split into rather than any organizational defect.

DimensionReasoningScore

Conciseness

The body is lean and assumes Claude's competence: it never explains what Dependabot or gh is, and every line (including the release-only caveat and the SHA/comment-sync note) is operational detail that earns its place.

5 / 5

Actionability

Copy-paste-ready commands are given throughout (gh pr list with a jq filter, gh pr diff --name-only, gh pr checks, ./actionlint -color, gh pr merge --squash --delete-branch) plus a fill-in verdict template covering the common case.

5 / 5

Workflow Clarity

A clear Phase 0→4 sequence with explicit validation checkpoints (CI green, SHA/tag consistency, stale-head re-check after rebase), a consent gate on merge, and a feedback loop (rebase → wait for mergeable + fresh CI → merge next).

5 / 5

Progressive Disclosure

Well-sectioned with clear headers and one-level-deep external references (AGENTS.md, docs/WORKFLOW.md for the CI job map); no bundle files exist, and all inline content (risk table, verdict template) is appropriately sized, so it sits just below the ideal split-into-references anchor.

4 / 5

Total

19

/

20

Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concrete, trigger-rich, and sharply scoped, explicitly answering both what it does and when to use it while distinguishing it from sibling Dependabot skills. It is slightly shy of full specificity only because it names two verbs rather than a longer action list.

DimensionReasoningScore

Specificity

Names the domain and two concrete actions ("Reviews and merges Dependabot pull requests" that "bump `uses:` pins in `.github/workflows/`") with a precise target, but only two verbs keep it just short of comprehensive coverage.

4 / 5

Completeness

Explicitly answers what ("Reviews and merges Dependabot pull requests for GitHub Actions ... that bump `uses:` pins") and when ("Use for Dependabot github_actions PRs (branches like `dependabot/github_actions/...`), not go.mod or site/ Bun PRs").

5 / 5

Trigger Term Quality

Covers natural terms a maintainer would say ("Dependabot pull requests", "GitHub Actions", "github_actions", ".github/workflows/", "go.mod", "site/ Bun PRs") including synonyms and file extensions.

5 / 5

Distinctiveness Conflict Risk

A clear narrow niche (github-actions ecosystem Dependabot) with explicit exclusion of the go.mod and site/Bun sibling skills, minimizing wrong-skill triggers.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 9 suspicious

Warning

Total

15

/

16

Passed

Repository
neilotoole/sq
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.