skills.rest
agorokh
agorokhCOMMUNITY
Explore all skills by this author →
GitHub

dependency-review

Review Dependabot PR dependency and workflow changes for supply-chain risks.

Updated Jul 5, 2026
Search Tags:#dependency management#github actions#mcp configuration#pull request review#cve triage#supply-chain security#ci workflow permissions
One-click install
npx skills add https://github.com/agorokh/applied-ai-research --skill dependency-review-agorokh
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependency-review
Source: https://github.com/agorokh/applied-ai-research/tree/main/.cursor/skills/dependency-review
Command: npx skills add https://github.com/agorokh/applied-ai-research --skill dependency-review-agorokh

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

It reduces the risk of regressions and security exposure caused by dependency, CI workflow, and supply-chain changes before they land in your repo.

Core Features & Use Cases

  • Pre-loaded substrate context: Retrieves prior risk decisions and known CVE/security patterns relevant to the bumped packages to avoid re-litigating past incident scars.
  • Targeted, touched-file review discipline: Reviews only the changed manifests/workflows plus the PR body to focus assessment and prevent scope creep.
  • Enterprise merge decision support: Produces a risk summary, recommends merge order when there are overlapping PRs, and delegates the required handoff/check completion to the PR-resolution follow-up agent loop.
  • Guardrails and safety checks: Enforces session lifecycle expectations and prevents secret leakage in commits/PR bodies.

Quick Start

Ask the agent to perform a dependency review for a Dependabot PR that updates pyproject/lockfile versions and GitHub Actions workflow actions, including querying the prior-risk substrate first.

Frequently Asked Questions about dependency-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review Dependabot pull requests for supply-chain security risks?▼

Reviewing Dependabot pull requests for supply-chain risks involves evaluating dependency bumps and workflow changes against prior incident scars and known CVE patterns. The process focuses strictly on touched manifests and PR bodies to assess breaking-major and permission-surface risks before merge.

What is dependency review for GitHub Actions workflow updates?▼

Dependency review for GitHub Actions workflow updates is the targeted assessment of CI workflow revisions and action version bumps for permission-surface and supply-chain risks. It prevents unauthorized access and breaking changes by evaluating only the touched workflow files and PR context.

Can I use automated dependency review for enterprise MCP configuration changes?▼

Yes, automated dependency review can evaluate `.mcp.json` configuration changes for enterprise deployment and compliance impacts. It assesses these configuration modifications alongside pip/pyproject bumps and workflow updates to maintain supply-chain security guardrails.

How do I triage CVE allow or ignore comments in pull requests?▼

Triaging CVE allow or ignore comments in pull requests involves reviewing security workflow revisions against pre-loaded substrate context of known vulnerabilities and past risk decisions. This prevents re-litigating incidents and ensures consistent allow or ignore decisions across dependency upgrades.

Does dependency review require prior workspace context to assess breaking-major risks?▼

Yes, dependency review requires mandatory prior substrate context via the memory-contract query to assess breaking-major risks accurately. It enforces strict workspace resolution from `ops/memory_manifest.yml` to retrieve prior risk decisions and known CVE patterns before evaluating changes.

What is the best way to determine merge order for overlapping Dependabot pull requests?▼

Determining merge order for overlapping Dependabot pull requests requires generating a risk summary that evaluates dependency conflicts and breaking changes across PRs. This recommends a safe merge sequence and delegates follow-up checks to an agentic handoff pointer for deterministic resolution.

Related Skills

Explore More Software Engineering Skills→
Foxfire1stFoxfire1st
27

c-04-retrieval-strategy-router

Route retrieval context to the correct memory substrate for ambiguous source decisions.

Community
Intermediate
mfittkomfittko
14

final-approval

Route dev loop execution to the canonical final approval and merge gate procedure.

Community
Basic
thesammykinsthesammykins

cicd-security

Harden CI/CD pipelines with secret management, runner isolation, and artifact verification.

Community
Advanced
AdamCavinessAdamCaviness
3

update-deps

Automate CVE-aware dependency updates across multi-package repositories with scoped changes and test validation.

Community
Advanced