CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/dependabot-config

Reference for `.github/dependabot.yml` - GitHub-native dependency-update orchestrator. Required keys (`version: 2`, `updates[]` array) plus per-update fields (`package-ecosystem`, `directory` / `directories`, `schedule.interval`); common optional fields (`ignore`, `groups`, `allow`, `labels`, `milestone`, `open-pull-requests-limit`, `target-branch`, `vendor`, `versioning-strategy`, `assignees`, `commit-message`); auto-rebase + grouped-PR + security-only updates. Use when authoring or reviewing Dependabot configs in GitHub-hosted repos.

73

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured reference skill: executable YAML throughout, clearly sequenced steps with an explicit validation-and-retry loop, and a genuine one-level-deep reference file for advanced material. The only weaknesses are mild — a few trimmable explanatory sentences and a spine that could offload a bit more to the reference file.

DimensionReasoningScore

Conciseness

The body is mostly tables, YAML blocks, and field lists — efficient with little padding. It matches the 4 anchor ('efficient; minor instances of over-explanation') because of a few trimmable spots, e.g. "Grouped PRs reduce review noise - instead of 30 individual PRs for dev-deps, get one consolidated PR" and the boundary paragraph distinguishing snyk-test/osv-scanner. Not the 5 anchor: not every token earns its place; not the 3 anchor: no section is genuinely unnecessary.

4 / 5

Actionability

All guidance is executable: copy-paste-ready YAML for top-level structure, monorepo `directories`, `ignore`, `groups`, `allow`, and a full multi-ecosystem example; concrete value enumerations (ecosystems, `interval` values, `versioning-strategy` options); specific UI paths for verification and triage. This matches the 5 anchor — concrete examples cover the common authoring/reviewing cases.

5 / 5

Workflow Clarity

Steps 1–7 are clearly sequenced (structure → required fields → optional fields → example → security → suppression → auto-merge), and the "Verify" block provides an explicit validation checkpoint with an error-recovery feedback loop: "if it flags a parse error, fix the reported key and re-push before relying on the config." This matches the 5 anchor (explicit validation + feedback loop); the 4 anchor would lack the fix-and-retry guidance.

5 / 5

Progressive Disclosure

The bundle structure is sound: one real reference file (references/dependabot-advanced.md) holding the full multi-ecosystem config and auto-merge workflow, referenced one level deep and clearly signaled twice plus in a References section, with no chained references. It sits between the 4 and 5 anchors: the split is appropriate, but the ~250-line spine carries substantial inline detail (Step 6 justification template, triage tables) that pushes it past a lean overview, so 'minor organization gaps' apply.

4 / 5

Total

18

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A dense, highly specific description that fully answers what and when with an explicit 'Use when' clause and third-person voice. Trigger coverage is strong with only a few natural synonyms missing.

DimensionReasoningScore

Specificity

The description enumerates concrete capabilities exhaustively: required keys ("`version: 2`, `updates[]` array"), per-update fields ("`package-ecosystem`, `directory` / `directories`, `schedule.interval`"), twelve named optional fields, and behaviors ("auto-rebase + grouped-PR + security-only updates"). This matches the 5 anchor ('multiple specific concrete actions; comprehensive coverage'); it is not the 4 anchor because coverage of the config surface has no notable gaps.

5 / 5

Completeness

Explicitly answers both what ("Reference for `.github/dependabot.yml` - GitHub-native dependency-update orchestrator" with full key enumeration) and when ("Use when authoring or reviewing Dependabot configs in GitHub-hosted repos") with concrete triggers. This is a direct match to the 5 anchor example pattern; the 4 anchor would require a vaguer 'when' clause.

5 / 5

Trigger Term Quality

Good natural-term coverage: "Dependabot configs", ".github/dependabot.yml", "GitHub-hosted repos", "dependency-update", "authoring or reviewing". It falls just short of the 5 anchor because common user phrasings like "keep dependencies up to date", "upgrade PRs", or "renovate alternative" are absent — matching 'good keyword coverage; a few natural terms missing'.

4 / 5

Distinctiveness Conflict Risk

"GitHub-native" plus "Dependabot" and ".github/dependabot.yml" carve a clear niche with distinct triggers and minimal conflict risk — a user needing this skill would say "dependabot". Not the 4 anchor: the only adjacent skill (renovate-config) is excluded by the GitHub-native and Dependabot-specific triggers.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents