Analyze a Dependabot PR and post a patrol-style risk assessment comment. Extracted from the patrol GitHub Action. Use for single-PR triage or as a building block in bulk workflows.
From dependabot-reviewnpx claudepluginhub app-vitals/marketplace --plugin dependabot-reviewThis skill is limited to using the following tools:
Triage Dependabot PR: $ARGUMENTS
gh pr view $ARGUMENTS --json number,title,body,author,headRefName,baseRefName,files,url
gh pr checks $ARGUMENTS --json name,status,conclusion 2>/dev/null || true
Extract:
title — the PR title (e.g. "Bump axios from 1.6.0 to 1.7.0")body — Dependabot's description of the changeauthor — should be dependabot[bot]files — changed files (usually package.json, package-lock.json, or yarn.lock)gh pr diff $ARGUMENTS
Look at the actual version bumps — what changed, how many semver levels.
Apply this triage rubric:
Recommendation options:
merge — safe patch/minor update, no breaking changes, low riskreview — significant version bump, possible breaking changes, or security-relevant; needs human eyeshold — known breaking change, deprecated package, or requires code changes before mergingFlags to assess:
breakingChange — major version bump (X.0.0 → Y.0.0), or Dependabot body explicitly mentions breaking changessecurityRelevant — CVE mentioned in body, or security-focused package (e.g. helmet, bcrypt, jsonwebtoken)productionImpact — package is in dependencies (not devDependencies); used in production pathsHeuristics:
merge unless security-flaggedmerge, check for deprecation warnings in bodyreview or hold; read the body carefullyreview minimum; flag securityRelevantdevDependencies only → lower production risk; usually merge or reviewgh pr view $ARGUMENTS --json comments --jq '.comments[] | select(.body | contains("<!-- patrol -->")) | .id'
If a patrol comment exists, note its ID — you'll replace it (delete first, then post fresh).
To delete:
gh api repos/{owner}/{repo}/issues/comments/{comment_id} -X DELETE
Format the comment exactly like this:
### {icon} Patrol: {label}
**{summary}**
{flags}
{reasoning}
<sub>🏔️ [patrol](https://github.com/app-vitals/patrol) · claude-sonnet-4-6</sub><!-- patrol -->
Where:
{icon}: ✅ for merge, ⚠️ for review, 🛑 for hold{label}: "Safe to merge" / "Needs review" / "Hold — action required"{summary}: one sentence, e.g. "Bumps axios from 1.6.0 to 1.7.0 — minor release, no breaking changes."{flags}: space-separated, only include applicable: 🔴 Breaking change, 🔒 Security relevant, 🏭 Production impact{reasoning}: 2-3 sentences explaining the recommendationPost with:
gh pr comment $ARGUMENTS --body "..."
Return a summary:
PR #<number>: <title>
Recommendation: <merge|review|hold>
Flags: <flags or "none">
Comment posted ✓
<!-- patrol --> HTML comment at the end of the comment body is the marker used to find and replace existing patrol comments.review over merge — it's safe.