Borrowing it
Nothing to install: this file belongs to rjwalters/kicad-tools. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/rjwalters/kicad-tools/main/.claude/commands/repo/deps.mdgit clone --depth 1 https://github.com/rjwalters/kicad-toolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/rjwalters/kicad-tools/deps)<a href="https://agentmods.dev/commands/rjwalters/kicad-tools/deps"><img src="https://agentmods.dev/badge/commands/rjwalters/kicad-tools/deps.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.07183 |
| Opus 5 | $0.00016 | $0.03592 |
| Sonnet 5 | $0.00007 | $0.01437 |
| Haiku 4.5 | $0.00003 | $0.00718 |
Grade A, and why
deps scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Subtle steeringlowPrompt injection
Instructions that bias recommendations or shape behaviour without the user noticing.
regardless of `interval: weekly`. Never tell the user to "expect your first PR Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 589 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/repo:deps — Third-Party Dependency Currency
Keep the repo's third-party dependencies current: npm / pip / cargo / Go packages and GitHub Actions. Two halves, usually run together:
- Install / verify Dependabot — the config file and the repo-level security-updates flag, which are two independent things.
- Triage open Dependabot PRs — what each one is, whether it's risky, and whether to take it.
This is the companion to [[update-tools]], not a part of it. update-tools
compares installer-managed tool packages (Loom, Anvil, Repo Skills) against a
local source clone; there is no source clone to diff for Dependabot, and
"triage incoming bot PRs" is a different activity from "update an installed
package." Keeping them separate keeps update-tools' comparison model intact.
Everything here either writes repo config, flips a repository setting, or
merges a PR — so like release, remote, followups, and update-tools,
this command always confirms first and never auto-applies. --check is the
report-only form.
Usage
/repo:deps # Report status + open Dependabot PRs, then offer actions
/repo:deps --check # Report only — never writes, never merges
/repo:deps --install # Only the install/verify half (config + security flag)
/repo:deps --review # Only the PR-triage half
/repo:deps --review 123 # Triage one PR in depth
Prerequisites
Dependabot is a GitHub feature. Confirm the repo is on GitHub before doing
anything else — if origin points at Gitea or another forge, say so and stop
rather than scaffolding config that will never run:
git config --get remote.origin.url # → derive OWNER/REPO; must be a GitHub host
gh auth status
Steps — install / verify
1. Report config and the security flag as two distinct items
Writing .github/dependabot.yml enables version updates only. Dependabot
security updates are a repository setting that is entirely independent — a
repo can have a perfectly good config file and still have CVE alerting off.
Check and report both:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 589 lines · 33 tokens per session scan A 6862c7339eab
deps is a command published in the GitHub repository rjwalters/kicad-tools (56 stars, last pushed today), licensed MIT. It adds 33 tokens to every session and 7,183 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (subtle steering). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
domains
Apply the CLI runtime and safety contract before executing a command. Runtime --help is authoritative.
access
Apply the CLI runtime and safety contract before executing a command. Runtime --help is authoritative.
check-release-health
Summarize the CI health of an OpenShift release using live data from the openshift-ci-mcp server.
merge-conflict-analysis
You are analyzing merge conflicts for PR #${{ pr-number }}.
analyst
Use when performing local analyst review before pushing PR changes. Assesses code quality, impact analysis, and maintainability.
release
Standalone SDK release command for the BUILD repo. Not a workspace phase — runs independently after any number of implement/redteam cycles. Handles PyPI publishing, documentation deployment, and CI management for the kailash Python SDK and its framework packages.