Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fmind/dotfiles/dependabotnpx skills add fmind/dotfiles --skill dependabotgit clone --depth 1 https://github.com/fmind/dotfilesWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00021 | $0.00890 |
| Opus 5 | $0.00010 | $0.00445 |
| Sonnet 5 | $0.00004 | $0.00178 |
| Haiku 4.5 | $0.00002 | $0.00089 |
Grade A, and why
dependabot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dependabot Dependency Management Standard
Canonical setup for GitHub Dependabot, an automated dependency update engine designed to keep dependencies and GitHub Actions pinned, secure, and current.
1. Principles
- Pin-Everything Strategy: Pin GitHub Actions to a major-version tag (
actions/checkout@v7) and Go, npm, and Python packages explicitly. Do not pin action SHAs — the tag already tracks security patches within the major, and SHAs turn every upstream patch into review noise. - Reduce PR Noise: Group minor, patch, and digest updates into single, consolidated pull requests using the Dependabot
groupsconfiguration (e.g., grouping GitHub Action updates or Go module updates) while leaving major updates separate. - Local Validation: Never merge automated updates blindly. Always run validation pipelines locally (
mise run checkandmise run test) before pushing/merging to verify compatibility and catch regressions. - No Auto-Merge: Do not configure auto-merge for dependencies. Automated systems cannot anticipate protocol, type-checking, or model drift.
2. Configuration Setup (.github/dependabot.yml)
Place a dependabot.yml at .github/dependabot.yml at the root of target repositories to manage updates, commit styling, and dependency groupings.
Example configuration for a repository with GitHub Actions and Go modules:
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
day: monday
commit-message:
prefix: "chore(deps)"
groups:
actions:
patterns:
- "*"
update-types:
- minor
- patch
- package-ecosystem: gomod
directory: /dot
schedule:
interval: weekly
day: monday
commit-message:
prefix: "chore(deps)"
groups:
go-modules:
patterns:
- "*"
update-types:
- minor
- patch
3. Workflow & Commands
- Verify Configuration: Dependabot validation is handled automatically by GitHub upon receiving pushes to
.github/dependabot.yml. Any syntax errors will be reported in the repository's "Insights" -> "Dependency graph" -> "Dependabot" tab. - Trigger Manual Checks: To force Dependabot to check for updates immediately, go to your repository on GitHub, navigate to Insights -> Dependency graph -> Dependabot, click on the status/last-check details for a package ecosystem, and click Check for updates.
- Local Verification: When a Dependabot PR is opened, fetch the branch locally and run static checkers and tests to verify correctness:
git fetch origin git checkout check-dependabot-branch mise run check mise run test
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 84 lines · 21 tokens per session scan A fc5fff713682
dependabot is a skill published in the GitHub repository fmind/dotfiles (4 stars, last pushed 2d ago), licensed MIT. It adds 21 tokens to every session and 890 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
scaffold-go
Scaffold a complete Go project with CI/CD, release pipeline, Makefile, sr.yaml, .envrc, and standard files. Uses go toolchain and make as the native build system. Loads on top of scaffold-project (run that first for cross-language standard files). Use when creating a new Go CLI, service, or module, or when the user…
scaffold-terraform
Scaffold a Terraform infrastructure project with CI/CD (plan on PR, apply on push), AWS OIDC auth, .envrc, and standard files. Uses terraform CLI as the native tool. Loads on top of scaffold-project (run that first for cross-language standard files). Use when creating infrastructure repos, or when the user mentions…
scaffold-node
Scaffold a complete Node/TypeScript project with CI/CD, release pipeline, sr.yaml, .envrc, and standard files. Uses pnpm and biome. Loads on top of scaffold-project (run that first for cross-language standard files). Use when creating a new Node.js app, TypeScript library, or website, or when the user mentions "new…
scaffold-python
Scaffold a complete Python project with CI/CD, release pipeline, justfile, sr.yaml, pyproject.toml, .envrc, and standard files. Uses uv, ruff, and justfile (Python lacks a native task runner like pnpm scripts, so just fills that gap). Loads on top of scaffold-project (run that first for cross-language standard files).…
sync-release
Owns release-pipeline conventions: sr.yaml schema, the sr CLI verbs (init/plan/prepare/ release) and urmzd/sr action, typed publishers (cargo/npm/pypi/docker/go/custom), monorepo workspace discovery, versionfiles/stagefiles mapping, and post-release patterns. Language-specific build targets live in scaffold-rust…
setup-ci
Defines GitHub Actions workflow structure: ci.yml + release.yml naming, concurrency groups, bot-commit skip, workflowcall reuse, App-token checkout, and optional fsrc/teasr steps. Language-specific pipelines live in scaffold-rust, scaffold-go, scaffold-python, scaffold-node, scaffold-terraform. Use when setting up…