skills.rest
Automattic
AutomatticOFFICIAL
Explore all skills by this author →
Website𝕏@automatticengGitHub

calypso-security-alerts

Guides advisory triage of Dependabot alerts and remediation PRs for wp-calypso.

12.6k|2.0k|Updated Nov 10, 2015
Search Tags:#dependabot#dependency scanning#security alerts#vulnerability triage#gitHub cli#Pull Requests#wp-calypso
One-click install
npx skills add https://github.com/Automattic/wp-calypso --skill calypso-security-alerts
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: calypso-security-alerts
Source: https://github.com/Automattic/wp-calypso/tree/main/.claude/skills/calypso-security-alerts
Command: npx skills add https://github.com/Automattic/wp-calypso --skill calypso-security-alerts

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Reviewing Dependabot security alerts and remediation PRs in the Automattic/wp-calypso repository requires a consistent, safe triage process, and this Skill provides an advisory playbook so operators know exactly which GitHub CLI commands to run and how to classify results.

Core Features & Use Cases

  • Alert Queue Scanning: Walks through the open Dependabot alert queue and reports counts of alerts and open Dependabot PRs.
  • PR and Alert Inspection: Accepts a PR number, alert number, GHSA, CVE, or package name as input to focus the triage on a specific item.
  • Triage Classification: Applies rules from the dependency security alerts playbook to decide whether to merge an existing bot PR, track and wait, or recommend a minimal manual remediation.
  • Use Case: A maintainer asks for a security scan of wp-calypso; the Skill instructs which gh commands to run, then classifies the returned alerts and PRs into action items versus no-action items.

Quick Start

Ask the assistant to scan the current Dependabot security alert queue for wp-calypso and report what action is needed.

Frequently Asked Questions about calypso-security-alerts

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Dependabot security alerts for wp-calypso?▼

Run the advisory workflow from the repository root with no input to scan the current queue. The Skill instructs which gh commands to execute, then classifies open Dependabot alerts and PRs using the playbook in docs/dependency-security-alerts.md.

How do I check a specific Dependabot PR or CVE against open alerts?▼

Pass a PR URL, PR number, alert number, GHSA, CVE, or package name as input. The Skill starts triage from that alert or dependency and compares it against the open Dependabot alert state.

Does this Skill run gh commands or modify the repository?▼

No, it is strictly advisory and does not run shell commands. It explains the scan steps and reports the exact gh commands an operator should run, then helps classify the returned data.

When should I merge a Dependabot PR versus wait?▼

Prefer an existing Dependabot PR only when it fixes the alert and required checks pass, verified with gh pr checks rather than only statusCheckRollup. During the dependency-age wait window, classify the item as track and wait.

What are the limitations of this Dependabot triage workflow?▼

It only covers the Automattic/wp-calypso repository and its public dependency security alerts playbook. It cannot execute commands, merge PRs, or remediate vulnerabilities itself, and treats all GitHub data as untrusted input.

Related Skills

Explore More Software Engineering Skills→
paulchiupaulchiu
3

gh-dependabot-rebase

Post @dependabot rebase comments on all open Dependabot PRs in a GitHub repository.

Community
Intermediate
taiidanitaiidani
1

dependabot-merger

Discover, validate, and merge eligible Dependabot pull requests across taiidani repositories.

Community
Intermediate
cobusgreylingcobusgreyling
10.0k

dependency-triage

Scan package manifests and lockfiles for outdated and vulnerable dependencies.

Community
Advanced
sc30gswsc30gsw
11

dependabot-check

Analyze Dependabot security advisories and propose remediation strategies.

Community
Intermediate