sq-site-dependabot

Reviews, validates, and safely merges Dependabot pull requests for the sq.io site (site/, Bun lockfile). Use when clearing site dependency PRs, triaging Dependabot failures, or checking Lighthouse impact before merge.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

92%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An excellent maintainer-workflow body: every phase carries executable commands, validation is explicit and placed before risky merge actions, and detail is properly offloaded to real, one-level-deep reference and script files. The only notable improvement is trimming minor repetition around the Layer A/B and full-mode-sequence restatements.

Suggestions

Consolidate the Layer A/Layer B conditions that are restated in Phase 3, the Netlify validation section, and the full-mode sequence diagram into a single canonical statement to save tokens.

Dimension	Reasoning	Score
Conciseness	The body is dense with commands, tables, and terse pointers — e.g. the operating-modes table and "check-tools.sh runs bun install in site/ when bun x netlify-cli is missing" — with essentially no explanation of concepts Claude already knows. Not a 5 because there is mild repetition (Layer A/B conditions restated across Phase 3, the Netlify section, and the Full-mode sequence diagram) that could be trimmed.	4 / 5
Actionability	Guidance is copy-paste ready throughout: the exact `gh pr list --author 'app/dependabot'` query with --jq filter, `make ci`, `make site-netlify-validate`, a concrete merge invocation with env vars (`CONFIRM_MERGE=1 PR=573 MESSAGE=...`), and polling commands with intervals and timeouts. This matches the fully-executable anchor covering the common cases.	5 / 5
Workflow Clarity	Phases 0–6 are clearly sequenced with explicit validation checkpoints exactly where this batch/destructive workflow needs them: stale-head guard re-checking headRefOid, Layer A green before Layer B, consent gating ("Only with explicit user consent"), failure recovery routed to references/merge-failures.md, and post-merge polling with a bounded timeout. The batch-operation validation requirement is fully satisfied, so no cap applies.	5 / 5
Progressive Disclosure	SKILL.md is a lean overview with well-signaled, one-level-deep references — all seven files in the Reference index exist in references/ and the three scripts (check-tools.sh, debug-netlify-pr.sh, merge-next.sh) exist in scripts/. Reference files cross-link only to siblings and repo paths, not to deeper nested detail, matching the clear-overview anchor.	5 / 5
	Total	19 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description in third-person voice that explicitly states concrete capabilities and includes a well-formed 'Use when...' clause with realistic trigger phrases. It is tightly scoped to the sq.io site/Dependabot niche, giving it minimal conflict risk. The only weakness is slightly incomplete action coverage and a few missing natural synonyms for dependency-update requests.

Suggestions

Mention the Netlify deploy-preview/CLI validation step in the capability list so the description reflects the skill's most distinctive action, not just 'reviews, validates, and safely merges'.

Add one or two natural trigger synonyms such as 'update site dependencies' or 'Bun lockfile updates' to broaden keyword coverage for users who don't say 'Dependabot'.

Dimension	Reasoning	Score
Specificity	"Reviews, validates, and safely merges Dependabot pull requests for the sq.io site (site/, Bun lockfile)" names the domain and three concrete actions with scoping detail. Not a 5 because coverage has minor gaps — the Netlify deploy-preview/CLI validation and audit/validate/full mode distinction, central to the skill, are only hinted at via "checking Lighthouse impact before merge".	4 / 5
Completeness	Both halves are explicit: the "what" is "Reviews, validates, and safely merges Dependabot pull requests..." and the "when" is the concrete trigger clause "Use when clearing site dependency PRs, triaging Dependabot failures, or checking Lighthouse impact before merge." This matches the score-5 anchor of clear what AND when with concrete trigger phrases, not the score-4 anchor where 'when' could be more specific.	5 / 5
Trigger Term Quality	Natural trigger phrases like "clearing site dependency PRs", "triaging Dependabot failures", and "Dependabot pull requests" match what a maintainer would actually say. Not a 5 because common variations such as "update dependencies", "dependency updates", or "bun" lockfile wording are absent, leaving a few natural terms missing.	4 / 5
Distinctiveness Conflict Risk	The description is tightly scoped to "Dependabot pull requests for the sq.io site (site/, Bun lockfile)", a clear niche with distinct triggers that would not fire for generic dependency, docs, or PR-review skills. It matches the minimal-conflict anchor; a score of 4 would require some overlap with closely related skills, which is not present.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 9 suspicious	Warning

	Total	15 / 16 Passed

Repository: neilotoole/sq
Path: .agents/skills/sq-site-dependabot/SKILL.md
Commit: 469b92b

Reviewed: 20 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.