Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/acolomba/pi-claude-marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/acolomba/pi-claude-marketplace/merge-dependabot-prs)<a href="https://agentmods.dev/commands/acolomba/pi-claude-marketplace/merge-dependabot-prs"><img src="https://agentmods.dev/badge/commands/acolomba/pi-claude-marketplace/merge-dependabot-prs/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/acolomba/pi-claude-marketplace/merge-dependabot-prs"><img src="https://agentmods.dev/badge/commands/acolomba/pi-claude-marketplace/merge-dependabot-prs.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.01219 |
| Opus 5 | $0.00026 | $0.00609 |
| Sonnet 5 | $0.00010 | $0.00244 |
| Haiku 4.5 | $0.00005 | $0.00122 |
Grade A, and why
merge-dependabot-prs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 63 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Merge Dependabot PRs
Land the routine dependency-bump PRs Dependabot opens against this repo, one at a time, without a human doing the sync/wait/fix/merge loop by hand. Each PR goes through the same four phases before moving to the next.
Phase 0 — Build the queue
gh pr list --search "author:app/dependabot" --state open --json number,title,headRefName,isDraft.
$ARGUMENTS, if it names a PR number, restricts the queue to that one PR; otherwise process every open Dependabot PR, lowest PR number (oldest) first. Skip drafts. If the queue is empty, say so and stop.
Re-derive this list at the start of every iteration, not just once — merging one PR can cause Dependabot or GitHub to close, rebase, or update others (e.g. two PRs touching the same lockfile), and a stale in-memory list can point at a PR that no longer needs handling.
Phase 1 — Sync from main (GitHub-side)
gh pr update-branch <PR#>. This merges main into the PR branch server-side and is a no-op if already up to date. Never pass --rebase — this project's convention is merge, not rebase, and rewriting history on a bot-owned branch fights Dependabot's own next push. If it reports a conflict, gh pr checkout <PR#>, git merge main locally, resolve, push — still no rebase.
Phase 2 — Wait for checks; fix on failure
gh pr checks <PR#> --watch --json name,bucket,workflowName,link— blocks until every check completes.- If everything is
passorskipping(SonarCloud is expected to skip on Dependabot PRs — no secrets access — that's not a failure), go to Phase 3. - On any
fail:gh pr checkout <PR#>.- Find the failing run (
gh run list --branch <headRefName> --limit 5, or the check'slink) and read it:gh run view <run-id> --log-failed. - Diagnose the real cause — usually the bump changed an API, a type, or tripped a lint rule. Fix the code, not the pin: don't quietly hold the dependency back to dodge the failure. If a genuine fix isn't mechanical, stop and report this PR instead of merging a workaround.
- Before committing:
npm run check, thenpre-commit run --all-files— fix, restage, re-run until clean. Never--no-verify. - Commit (Conventional Commits) and push to the PR branch.
- Back to step 1.
- Cap at 4 fix rounds. If a round doesn't shrink the failing-check count, or a fix reappears, stop, leave this PR unmerged, and move to the next one in the queue.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 63 lines · 52 tokens per session scan A 2640f0b7ed21
merge-dependabot-prs is a command published in the GitHub repository acolomba/pi-claude-marketplace (23 stars, last pushed 3d ago), licensed MIT. It adds 52 tokens to every session and 1,219 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other commands, from other repositories
commit
A command that examines staged Git changes and proposes a commit message using the Conventional Commits format, such as feat, fix, or docs. Git is a tool for tracking changes to code.
merge-conflict-analysis
You are analyzing merge conflicts for PR #${{ pr-number }}.
release-notes
Generate consistent, well-structured release notes from git history. Triggered on release tags following semver patterns (v..) to produce categorized changelog with breaking changes, features, fixes, and contributor attribution.
doctor
Diagnosticar y reparar problemas del framework Don Cheli, git y entorno. Usa cuando el usuario dice "doctor", "problemas del framework", "don cheli no funciona", "repair Don Cheli", "debug setup", "setup broken", "framework broken", "reparar entorno". Detecta y repara issues de configuración, git y dependencias…
handoff
Export a Waybill Bundle by default, or import one when requested.
repo-audit
Audit a codebase (local or remote GitHub/GitLab) against architecture principles and requirements, surfacing drift, risk, and missing decisions.