Radar is a single-binary graphical interface for Kubernetes, the system used to run and manage containerized applications across clusters. It helps developers and operators inspect resources, topology, events, Helm deployments, GitOps, traffic, audits, and upgrade impact, while its built-in MCP server lets AI agents inspect and operate clusters through Radar.
Borrowing it
Nothing to install: this file belongs to skyhook-io/radar. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/skyhook-io/radar/main/.claude/commands/dependabot-batch.mdgit clone --depth 1 https://github.com/skyhook-io/radarWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/skyhook-io/radar/dependabot-batch)<a href="https://agentmods.dev/commands/skyhook-io/radar/dependabot-batch"><img src="https://agentmods.dev/badge/commands/skyhook-io/radar/dependabot-batch/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/skyhook-io/radar/dependabot-batch"><img src="https://agentmods.dev/badge/commands/skyhook-io/radar/dependabot-batch.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00019 | $0.01846 |
| Opus 5.5 | $0.00008 | $0.00738 |
| Sonnet 5.5 | $0.00004 | $0.00369 |
| Haiku 4.5 | $0.00002 | $0.00185 |
Grade A, and why
dependabot-batch scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dependabot Batch
Replace Radar's open weekly Dependabot PRs with one evidence-backed dependency PR. Include only updates that have been published for at least 72 hours and look safe after upstream review and Radar-specific testing. Do not merge the resulting PR.
This command is end-to-end unless the user asks for an audit only or says not to create a PR. Creating the batch PR includes pushing its branch and closing only the Dependabot PRs it supersedes. It does not authorize merging, publishing, tagging, or changing release artifacts.
Non-negotiable gates
- Measure soak from the target version's upstream publication time, never from the Dependabot PR creation time. Record the screening time in UTC. A version must be at least 72 hours old at that instant; do not round up or make exceptions without explicit user approval.
- Apply the gate to the final resolved dependency graph, including transitive upgrades and newly introduced packages. A lockfile or module resolver can move beyond the version named in a PR.
- Read the official release notes or changelog for every direct candidate across the complete old-to-new range. Review official release metadata and meaningful changes for every changed transitive dependency too. If notes are missing or vague, inspect the upstream compare/commit range; uncertainty raises risk rather than counting as evidence of safety.
- Use primary sources: upstream releases, changelogs, compare views, issue trackers/security advisories, npm registry metadata, the Go module proxy, and GitHub tag/release metadata. Dependabot's summary and compatibility score are leads, not the review.
- Do not execute lifecycle/install scripts from a candidate package before it clears the soak and review gates.
npm install --package-lock-only --ignore-scriptsornpm ci --ignore-scriptsis appropriate while constructing/auditing the graph; run the repository's normal verification after the included set is approved. - Keep the batch dependency-only. If an update requires Radar source changes, a migration, or a speculative compatibility fallback, exclude it and explain the needed follow-up. Version-locked companion packages may move together when upstream requires it, but each resolved version must clear the same review and soak gates.
- Preserve unrelated work. Start from current
origin/mainon a dedicateddeps/dependabot-batch-YYYY-MM-DDbranch, using a separate worktree when the current tree is dirty or in active use.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 102 lines · 19 tokens per session scan A a00f916a0d72
dependabot-batch is a command published in the GitHub repository skyhook-io/radar (3,969 stars, last pushed today), licensed Apache-2.0. It adds 19 tokens to every session and 1,846 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
release
Release manager for frontend and mobile. Writes App Store notes, user-facing changelog, flags stale docs and landing copy. Actions: notes | changelog | docs | sync.
ia-document-release
Post-ship documentation sync. Reads all project docs, cross-references the diff, updates README/ARCHITECTURE/CONTRIBUTING/CLAUDE.md to match what shipped, polishes CHANGELOG voice, and optionally bumps the version.
ia-changelog
Create engaging changelogs for recent merges to main branch.
release
create a release PR (auto-detects previous tag).
release-tag
Create and push a version tag after a release PR has been merged.
release
Bump version, commit, push, mirror to ai-skills, and update local plugin.