dependabot-alert-issue

What problem does it solve?

Manually tracking, triaging, and creating GitHub Issues for Dependabot alerts and external audit findings is time-consuming, prone to duplicate work, and often leads to inconsistent grouping or missed vulnerabilities. This skill eliminates that manual overhead by automating the entire workflow from alert retrieval to draft Issue creation.

Core Features & Use Cases

• Dual Input Support: Fetches all open Dependabot alerts with proper pagination, or accepts normalized external audit findings (e.g., pnpm audit JSON) as input for repositories where Dependabot is not yet supported.
• Actionability-Based Triage: Automatically skips already addressed vulnerabilities (via existing Issues/PRs), applies user-defined ignore/dismiss rules, and classifies alerts as immediately actionable or blocked (with documented blockers like unreleased patches or fixed transitive dependencies).
• Smart Grouping: Groups actionable vulnerabilities by severity and blocked ones by package + patched version to create clean, non-duplicate Issues with titles that follow your repository's commit conventions.
• Use Case: For a team maintaining a production Node.js service, this skill can automatically create a single high-severity Issue for all critical lodash vulnerabilities that can be fixed in one batch, and a separate blocked Issue for transitive dependencies waiting on an upstream release, cutting triage time from hours to minutes.

Quick Start

Use the dependabot-alert-issue skill to create grouped GitHub Issues for all open Dependabot alerts in the current repository, following your project's commit title conventions.