skills.rest
shoji9x9
shoji9x9COMMUNITY
Explore all skills by this author →
𝕏@shoji9x9GitHub

dependabot-alert-issue

Automate Dependabot alert triage and GitHub Issue creation.

Updated May 31, 2026
Search Tags:#automation#vulnerability#github#audit#issue-creation#dependabot#dependency-security
One-click install
npx skills add https://github.com/shoji9x9/skills --skill dependabot-alert-issue
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependabot-alert-issue
Source: https://github.com/shoji9x9/skills/tree/main/.agents/skills/dependabot-alert-issue
Command: npx skills add https://github.com/shoji9x9/skills --skill dependabot-alert-issue

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Manually tracking, triaging, and creating GitHub Issues for Dependabot alerts and external audit findings is time-consuming, prone to duplicate work, and often leads to inconsistent grouping or missed vulnerabilities. This skill eliminates that manual overhead by automating the entire workflow from alert retrieval to draft Issue creation.

Core Features & Use Cases

  • Dual Input Support: Fetches all open Dependabot alerts with proper pagination, or accepts normalized external audit findings (e.g., pnpm audit JSON) as input for repositories where Dependabot is not yet supported.
  • Actionability-Based Triage: Automatically skips already addressed vulnerabilities (via existing Issues/PRs), applies user-defined ignore/dismiss rules, and classifies alerts as immediately actionable or blocked (with documented blockers like unreleased patches or fixed transitive dependencies).
  • Smart Grouping: Groups actionable vulnerabilities by severity and blocked ones by package + patched version to create clean, non-duplicate Issues with titles that follow your repository's commit conventions.
  • Use Case: For a team maintaining a production Node.js service, this skill can automatically create a single high-severity Issue for all critical lodash vulnerabilities that can be fixed in one batch, and a separate blocked Issue for transitive dependencies waiting on an upstream release, cutting triage time from hours to minutes.

Quick Start

Use the dependabot-alert-issue skill to create grouped GitHub Issues for all open Dependabot alerts in the current repository, following your project's commit title conventions.

Frequently Asked Questions about dependabot-alert-issue

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate creating GitHub Issues from Dependabot alerts?▼

Grouping Dependabot alerts by severity and package allows this skill to batch related vulnerabilities into clean, non-duplicate GitHub Issues, preventing inconsistent manual tracking and ensuring titles follow your repository's commit conventions.

Can I use pnpm audit JSON to create GitHub Issues for dependency vulnerabilities?▼

Yes, you can use normalized pnpm audit JSON as input. This skill accepts external audit findings for repositories where native Dependabot is not yet supported, processing them through the same triage and grouping workflow to create GitHub Issues.

How does automated vulnerability triage handle blocked or unreleased patches?▼

Automated vulnerability triage classifies alerts as immediately actionable or blocked. Blocked vulnerabilities, such as those with unreleased patches or fixed transitive dependencies, are grouped separately by package and patched version with documented blockers.

Does the Dependabot alert triage process skip existing Issues and Pull Requests?▼

Yes, the Dependabot alert triage process automatically skips already addressed vulnerabilities by detecting existing Issues and Pull Requests, applying user-defined ignore and dismiss rules to eliminate duplicate manual tracking work.

What is the best way to group critical dependency vulnerabilities for a production Node.js service?▼

The best way to group critical dependency vulnerabilities is by actionability and severity. This skill creates a single high-severity Issue for batch-fixable vulnerabilities and separate blocked Issues for transitive dependencies waiting on upstream releases.

Related Skills

Explore More Software Engineering Skills→
shoji9x9shoji9x9

pnpm-audit-alert-issue

Normalize pnpm audit JSON output into structured findings with dependency paths.

Community
Intermediate
alextangsonalextangson
1

xhs-cover-review

Generate three Xiaohongshu cover prototypes and enforce approval before publish-ready status.

Community
Advanced
synaptiaisynaptiai
6

convention-enforcement

Validate git history and pull requests against repository-specific conventions.

Official
Intermediate
dreadnodedreadnode
11

vuln-critic

Filter low-quality and false positive vulnerability findings from scanners and agent output.

Official
Intermediate