Plan and execute backend and frontend Dependabot remediation with wave-based sequencing, resolver validation, and post-merge closure checks.
Manages Dependabot security alerts by orchestrating backend and frontend remediation waves with validation gates and closure checks.
/plugin marketplace add diversioteam/agent-skills-marketplace/plugin install dependabot-remediation@diversiotechThis skill is limited to using the following tools:
references/backend-github-dependabot-cli.mdreferences/backend-wave-plan-template.mdreferences/dependabot-yml-minimal-template.mdreferences/dependabot-yml-review-checklist.mdreferences/dependency-review-ci-policy-template.mdreferences/frontend-manual-remediation-playbook.mdreferences/frontend-release-pr-template.mdreferences/frontend-triage-matrix.mdUse this skill when a repository has open Dependabot security alerts and you need a deterministic remediation flow with clear evidence and rollback paths.
Use it for:
uv + pyproject.toml repos).npm, yarn, or pnpm).backend <triage|execute-wave <N>|release>:
triage: Review/create dependabot.yml, then build backend alert inventory and wave plan.execute-wave <N>: Execute one backend wave with strict gates.release: Validate closure and prepare backend remediation release summary.frontend <triage|execute|release>:
triage: Review/create dependabot.yml, then build frontend PR/alert triage matrix.execute: Execute frontend close/recreate/merge/manual flow.release: Create frontend release summary for remediation changes.Severity tags:
[BLOCKING] cannot proceed safely[SHOULD_FIX] high-value correction before merge[NIT] optional improvementBefore backend or frontend execution:
git status -sb
git branch --show-current
gh auth status
If GitHub auth is missing or token lacks alert permissions, stop with [BLOCKING].
triage)Before backend/frontend alert triage, validate repository configuration:
gh repo view..github/dependabot.yml:
references/dependabot-yml-minimal-template.md.--write-config is set: create .github/dependabot.yml.references/dependabot-yml-review-checklist.md.[BLOCKING] config gaps that invalidate remediation claims.If --config-only is set, stop after config create/review + CI policy advice.
backend triage)Goal: produce deduplicated advisory inventory plus executable waves.
Required workflow:
package + GHSA + first_patched_version.Primary references:
references/backend-github-dependabot-cli.mdreferences/backend-wave-plan-template.mdreferences/dependabot-yml-minimal-template.mdreferences/dependabot-yml-review-checklist.mdreferences/dependency-review-ci-policy-template.mdbackend execute-wave <N>)Execution rules:
Backend validation gates must include:
uv lock --check or repo equivalent)ty firstpyright secondmypy thirdIf ty is configured ([tool.ty], ty.toml, .bin/ty, or CI usage), treat it
as mandatory and blocking.
backend release)After waves merge:
frontend triage)Goal: classify open bot PRs and alerts into actionable lanes.
Always scope PR inventory to the frontend base branch (auto-detect from
gh repo view ... defaultBranchRef unless overridden) so backend Dependabot
PRs are not mixed into the matrix.
Required workflow:
actionable, obsolete, or stale-but-recreate.Classification classes:
actionableobsoletestale-but-recreateReferences:
references/frontend-triage-matrix.mdreferences/dependabot-yml-minimal-template.mdreferences/dependabot-yml-review-checklist.mdreferences/dependency-review-ci-policy-template.mdfrontend execute)Execution policy:
@dependabot recreate.References:
references/frontend-triage-matrix.mdreferences/frontend-manual-remediation-playbook.mdfrontend release)Generate remediation release summary for integration branch -> production branch:
Reference:
references/frontend-release-pr-template.mdAlways return:
Current StateDependabot Config Status (existing/reviewed or created/proposed)Backend Scope Filter (ecosystem/path rules used)Deduplicated Alert InventoryRoot-Cause Dependency PathsProposed Waves or Wave Execution SummaryValidation GatesRisks and RollbackNext ActionsAlways return:
InventoryDependabot Config Status (existing/reviewed or created/proposed)Triage MatrixExecution SummaryRisk SnapshotNext Actionsdependabot.yml is reviewed or created.Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations.
Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply.
Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.