Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/fmflurry/settings-opencodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/fmflurry/settings-opencode/dependabot-friday)<a href="https://agentmods.dev/commands/fmflurry/settings-opencode/dependabot-friday"><img src="https://agentmods.dev/badge/commands/fmflurry/settings-opencode/dependabot-friday/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/fmflurry/settings-opencode/dependabot-friday"><img src="https://agentmods.dev/badge/commands/fmflurry/settings-opencode/dependabot-friday.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.01060 |
| Opus 5.5 | $0.00014 | $0.00424 |
| Sonnet 5.5 | $0.00007 | $0.00212 |
| Haiku 4.5 | $0.00003 | $0.00106 |
Grade A, and why
dependabot-friday scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 27d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 43 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dependabot Friday Command
Delegate to the git-specialist agent for a report-only triage of all open Dependabot PRs. This command never merges, closes, rebases, or comments — every mutation is emitted as a ⚠️ HUMAN CONFIRMATION REQUIRED block and executed only after explicit user approval.
Task
- Inventory —
gh pr list --author "app/dependabot" --state open --json number,title,headRefName,createdAt. If empty, report "no open Dependabot PRs" and stop. - Per-PR status — for each PR: CI verdict (
gh pr checks <n>), multi-ecosystem group (from the commit prefix:chore(deps-app)= npm + nuget + pip,chore(deps-infra)= docker + docker-compose + github-actions; the ecosystems actually touched are listed in the PR body), semver level of each bump (patch/minor/major, from the PR title/body), and mergeability (gh pr view <n> --json mergeable,mergeStateStatus). - Guardrail cross-check — read
.github/dependabot.ymland verify against itsignorerules:- Exactly two version-update PRs are expected (
app-deps,infra-deps). Achore(deps-*)PR outside those two prefixes is either a security update (not grouped bymulti-ecosystem-groups, expected to arrive on its own and bypass cooldown) or a config regression — say which. A nuget "Pinned " twin PR or a stale unsuperseded pair is the known nuget-updater noise documented in the config, not a grouping bug: list it under NEEDS-INVESTIGATION with the close command. - Paired pins move together or not at all. Currently: the langfuse SDK (
/litellmpip entry) and thelangfuse/langfuse+langfuse/langfuse-workerserver images (docker-compose entry) are the two halves of one pin — a PR bumping one half across a major is a REJECT (this is exactly how PR #59/#69/#81 recurred). Since the two-group layout they land in DIFFERENT PRs (SDK inapp-deps, images ininfra-deps), so check both PRs together before clearing either. - Ignored majors must not appear (typescript major in
/frontend, postgres major, langfuse major). If one shows up anyway, the ignore rules are broken — flag it as a config bug, do not plan a merge.
- Exactly two version-update PRs are expected (
- Classify each PR into a tier:
- MERGE-READY — CI green, patch/minor only, no guardrail hit.
- NEEDS-INVESTIGATION — CI red, or
mergeStateStatusdirty/behind: include the failing job names and a one-line diagnosis. - MAJOR / DEFERRED — any semver-major bump: each needs its own migration decision; never merged in the Friday batch. Exception:
github-actionsmajors may stay MERGE-READY when CI is green (actions are SHA-pinned and single-purpose), but call the major out explicitly in the report.
- Merge plan — order the MERGE-READY PRs sequentially (the two grouped PRs do not share files, but any security PR conflicts with its group PR on lockfiles; after each merge Dependabot rebases the remaining ones, so note the expected rebase wait between merges). Emit the exact commands in one confirmation block:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 27d ago First seen · 43 lines · 34 tokens per session scan A 092a8e37103a
dependabot-friday is a command published in the GitHub repository fmflurry/settings-opencode (171 stars, last pushed yesterday), licensed MIT. It adds 34 tokens to every session and 1,060 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-20.
Other commands, from other repositories
ship
Deploy feature through automated staging validation to production with rollback testing.
merge-conflict-analysis
You are analyzing merge conflicts for PR #${{ pr-number }}.
validate-pr-description
Use when validating a PR title and description for conventional commit format, issue linking keywords, and template compliance before submission.
issue-to-mr-setup
Create an automation that implements GitLab issues when a configurable trigger label is applied. Polls one or more projects deterministically, clones the default branch, starts one OpenHands conversation per label event, then commits, pushes, and opens the merge request itself.
ci
Run CI validation, create PRs, and merge on green.
run-plan
Execute implementation plan phases for a change.