Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add fpindej/netrock --skill review-dependabotgit clone --depth 1 https://github.com/fpindej/netrockWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fpindej/netrock/review-dependabot)<a href="https://agentmods.dev/skills/fpindej/netrock/review-dependabot"><img src="https://agentmods.dev/badge/skills/fpindej/netrock/review-dependabot/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fpindej/netrock/review-dependabot"><img src="https://agentmods.dev/badge/skills/fpindej/netrock/review-dependabot.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.01172 |
| Opus 5.5 | $0.00017 | $0.00469 |
| Sonnet 5.5 | $0.00008 | $0.00234 |
| Haiku 4.5 | $0.00004 | $0.00117 |
Grade A, and why
review-dependabot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Reviews a Dependabot PR and evaluates whether it is safe to merge.
Argument: PR number or URL.
Open Dependabot PRs:
!gh pr list --author 'app/dependabot' --json number,title --jq '.[] | "#\(.number) \(.title)"' 2>/dev/null | head -10 || echo "(none found)"
Steps
- Fetch PR metadata:
gh pr view {number} --json number,title,headRefName,body,labels,author - Verify the author is
app/dependabot. If it is not, STOP and report - this skill fetches and builds the PR's code locally, and that is only acceptable for Dependabot-authored version bumps. Never proceed for an arbitrary PR number. - Get the diff:
gh pr diff {number} - Identify the package, old version, new version, and version bump type (patch / minor / major)
Determine scope
| Signal | How to check |
|---|---|
| Backend (.NET) | Diff touches Directory.Packages.props |
| Frontend (pnpm) | Diff touches package.json / pnpm-lock.yaml |
| Dev-only dependency | Package appears only in test projects, build tooling, or devDependencies |
| Production dependency | Package is imported/used in shipped code |
Evaluate risk
1. Version bump type
- Patch (x.y.Z) - bug fixes, low risk
- Minor (x.Y.0) - new features, backwards-compatible by semver, low-medium risk
- Major (X.0.0) - potentially breaking, high risk - requires careful review
2. Changelog review
- Read the Dependabot PR body for release notes / changelog links
- If the PR body includes a changelog summary, check for breaking changes, deprecations, and behavioral changes
- For major bumps:
WebFetchthe changelog URL if provided
3. Usage impact
- Search the codebase for direct imports/usages of the package:
- .NET:
grep -r "using.*{PackageNamespace}" src/backend/and check.csprojreferences - Frontend:
grep -r "from ['\"].*{package}" src/frontend/src/
- .NET:
- Check if the package is a transitive dependency (only in lock file, not directly referenced)
- For major bumps: check if any API surface we use was deprecated or removed
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 102 lines · 42 tokens per session scan A bdc0b46500a6
review-dependabot is a skill published in the GitHub repository fpindej/netrock (234 stars, last pushed 5d ago), licensed MIT. It adds 42 tokens to every session and 1,172 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
fleet-review
Code review checklist and PR review workflow for Fleet QA agents.
api-design
Guidelines for RESTful API design, resource hierarchies, endpoint naming conventions, and standardizing JSON responses.
python
Enforces FastAPI, Dependency Injection, and general Python coding standards using uv inside the server directory.
react
Guidelines for the React frontend, TanStack ecosystem, and React 19 standards using pnpm inside web/.
project-setup
Step-by-step instructions and CLI commands to initialize a fresh fullstack clean architecture project (React 19 + Vite frontend in web/ and FastAPI + SQLAlchemy async backend in server/) using the latest package versions via pnpm and uv without cloning.
clean-code
Clean Code principles applied to this TypeScript / Next.js / React project, with a strong emphasis on eliminating duplication (DRY). Use before writing new code, during refactors, after Sonar flags duplicatedlines, or when reviewing a PR that adds similar-looking code to existing modules.