Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add boshi-xixixi/TraeSkill --skill dependabotgit clone --depth 1 https://github.com/boshi-xixixi/TraeSkillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/boshi-xixixi/traeskill/dependabot)<a href="https://agentmods.dev/skills/boshi-xixixi/traeskill/dependabot"><img src="https://agentmods.dev/badge/skills/boshi-xixixi/traeskill/dependabot.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00136 | $0.03321 |
| Opus 5 | $0.00068 | $0.01661 |
| Sonnet 5 | $0.00027 | $0.00664 |
| Haiku 4.5 | $0.00014 | $0.00332 |
Grade A, and why
dependabot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 454 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dependabot Configuration & Management
Overview
Dependabot is GitHub's built-in dependency management tool with three core capabilities:
- Dependabot Alerts — Notify when dependencies have known vulnerabilities (CVEs)
- Dependabot Security Updates — Auto-create PRs to fix vulnerable dependencies
- Dependabot Version Updates — Auto-create PRs to keep dependencies current
All configuration lives in a single file: .github/dependabot.yml on the default branch. GitHub does not support multiple dependabot.yml files per repository.
Configuration Workflow
Follow this process when creating or optimizing a dependabot.yml:
Step 1: Detect All Ecosystems
Scan the repository for dependency manifests. Look for:
| Ecosystem | YAML Value | Manifest Files |
|---|---|---|
| npm/pnpm/yarn | npm |
package.json, package-lock.json, pnpm-lock.yaml, yarn.lock |
| pip/pipenv/poetry/uv | pip |
requirements.txt, Pipfile, pyproject.toml, setup.py |
| Docker | docker |
Dockerfile |
| Docker Compose | docker-compose |
docker-compose.yml |
| GitHub Actions | github-actions |
.github/workflows/*.yml |
| Go modules | gomod |
go.mod |
| Bundler (Ruby) | bundler |
Gemfile |
| Cargo (Rust) | cargo |
Cargo.toml |
| Composer (PHP) | composer |
composer.json |
| NuGet (.NET) | nuget |
*.csproj, packages.config |
| .NET SDK | dotnet-sdk |
global.json |
| Maven (Java) | maven |
pom.xml |
| Gradle (Java) | gradle |
build.gradle |
| Terraform | terraform |
*.tf |
| OpenTofu | opentofu |
*.tf |
| Helm | helm |
Chart.yaml |
| Hex (Elixir) | mix |
mix.exs |
| Swift | swift |
Package.swift |
| Pub (Dart) | pub |
pubspec.yaml |
| Bun | bun |
bun.lockb |
| Dev Containers | devcontainers |
devcontainer.json |
| Git Submodules | gitsubmodule |
.gitmodules |
| Pre-commit | pre-commit |
.pre-commit-config.yaml |
Note: pnpm and yarn both use the npm ecosystem value.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 454 lines · 136 tokens per session scan A 85179928b083
dependabot is a skill published in the GitHub repository boshi-xixixi/TraeSkill (261 stars, last pushed 3mo ago), licensed MIT. It adds 136 tokens to every session and 3,321 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
commit-message
A guide for writing clear, traceable Git commit messages using the Conventional Commits format, which labels changes such as features, bug fixes, documentation, and refactoring.
chinese-commit-conventions
A Chinese-language guide to Conventional Commits, a format for writing consistent Git commit messages, plus related changelog, commit-checking, and commit-helper configuration.
ship-it
A GitHub workflow for finishing an implemented issue: commit the relevant changes, push a branch, create a pull request, merge it, and close the issue. GitHub is a service for hosting code and reviewing changes, and a pull request is a proposed change for review.
azure-repos
Expert knowledge for Azure Repos development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, and integrations & coding patterns. Use when managing Git/TFVC repos, branch/PR policies, CLI/IDE integrations, CodeQL/scanning, or…
regrouping-git-history
Rebuild a tangled feature branch into a small set of reviewer-friendly logical commits while preserving its final tree byte-for-byte. Use when asked to regroup, squash, tidy, or rewrite a branch with many interleaved feature, fixup, review, merge, or formatting commits. Resolve the actual PR base, plan groups with the…
pr
Commit scoped local changes, push a branch, and open a pull request following repository conventions for naming, commit format, templates, issue links, readiness, and reviewers. Use when the user asks to open a PR, commit and push, or as the publishing stage of $ship.