Plan and execute backend and frontend Dependabot remediation with wave-based sequencing, resolver validation, and post-merge closure checks.
How this skill is triggered — by the user, by Claude, or both
Slash command
/dependabot-remediation:dependabot-remediationThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Use this skill when a repository has open Dependabot security alerts and you
references/backend-github-dependabot-cli.mdreferences/backend-wave-plan-template.mdreferences/dependabot-yml-minimal-template.mdreferences/dependabot-yml-review-checklist.mdreferences/dependency-review-ci-policy-template.mdreferences/frontend-manual-remediation-playbook.mdreferences/frontend-release-pr-template.mdreferences/frontend-triage-matrix.mdUse this skill when a repository has open Dependabot security alerts and you need a deterministic remediation flow with clear evidence and rollback paths.
Use it for:
uv + pyproject.toml repos).npm, yarn, or pnpm).backend <triage|execute-wave <N>|release>:
triage: Review/create dependabot.yml, then build backend alert inventory and wave plan.execute-wave <N>: Execute one backend wave with strict gates.release: Validate closure and prepare backend remediation release summary.frontend <triage|execute|release>:
triage: Review/create dependabot.yml, then build frontend PR/alert triage matrix.execute: Execute frontend close/recreate/merge/manual flow.release: Create frontend release summary for remediation changes.Severity tags:
[BLOCKING] cannot proceed safely[SHOULD_FIX] high-value correction before merge[NIT] optional improvementBefore backend or frontend execution:
git status -sb
git branch --show-current
gh auth status
If GitHub auth is missing or token lacks alert permissions, stop with [BLOCKING].
triage)Before backend/frontend alert triage, validate repository configuration:
gh repo view..github/dependabot.yml:
references/dependabot-yml-minimal-template.md.--write-config is set: create .github/dependabot.yml.references/dependabot-yml-review-checklist.md.[BLOCKING] config gaps that invalidate remediation claims.If --config-only is set, stop after config create/review + CI policy advice.
backend triage)Goal: produce deduplicated advisory inventory plus executable waves.
Required workflow:
package + GHSA + first_patched_version.Primary references:
references/backend-github-dependabot-cli.mdreferences/backend-wave-plan-template.mdreferences/dependabot-yml-minimal-template.mdreferences/dependabot-yml-review-checklist.mdreferences/dependency-review-ci-policy-template.mdbackend execute-wave <N>)Execution rules:
Backend validation gates must include:
uv lock --check or repo equivalent)ty firstpyright secondmypy thirdIf ty is configured ([tool.ty], ty.toml, .bin/ty, or CI usage), treat it
as mandatory and blocking.
backend release)After waves merge:
frontend triage)Goal: classify open bot PRs and alerts into actionable lanes.
Always scope PR inventory to the frontend base branch (auto-detect from
gh repo view ... defaultBranchRef unless overridden) so backend Dependabot
PRs are not mixed into the matrix.
Required workflow:
actionable, obsolete, or stale-but-recreate.Classification classes:
actionableobsoletestale-but-recreateReferences:
references/frontend-triage-matrix.mdreferences/dependabot-yml-minimal-template.mdreferences/dependabot-yml-review-checklist.mdreferences/dependency-review-ci-policy-template.mdfrontend execute)Execution policy:
@dependabot recreate.References:
references/frontend-triage-matrix.mdreferences/frontend-manual-remediation-playbook.mdfrontend release)Generate remediation release summary for integration branch -> production branch:
Reference:
references/frontend-release-pr-template.mdAlways return:
Current StateDependabot Config Status (existing/reviewed or created/proposed)Backend Scope Filter (ecosystem/path rules used)Deduplicated Alert InventoryRoot-Cause Dependency PathsProposed Waves or Wave Execution SummaryValidation GatesRisks and RollbackNext ActionsAlways return:
InventoryDependabot Config Status (existing/reviewed or created/proposed)Triage MatrixExecution SummaryRisk SnapshotNext Actionsdependabot.yml is reviewed or created.npx claudepluginhub diversioteam/agent-skills-marketplace --plugin dependabot-remediationReviews open Dependabot PRs, classifies by risk (patch/minor/major/security/lockfile-only), merges safe ones via GitHub CLI, and advises on others. Use for dependency update triage.
This skill should be used when the user asks to "review Dependabot alerts", "check for vulnerable dependencies", "audit third-party packages", "assess supply chain risk", "run Grype scan", or needs to evaluate dependency health, transitive risk, or supply chain security.
Resolves Dependabot alerts and PRs by analyzing GitHub issues, running pnpm audit, applying updates, syncing Playwright Docker images, and creating a changelog PR with quality checks.