Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add LucasSantana-Dev/sharekit --skill dep-sweepgit clone --depth 1 https://github.com/LucasSantana-Dev/sharekitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lucassantana-dev/sharekit/dep-sweep)<a href="https://agentmods.dev/skills/lucassantana-dev/sharekit/dep-sweep"><img src="https://agentmods.dev/badge/skills/lucassantana-dev/sharekit/dep-sweep/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lucassantana-dev/sharekit/dep-sweep"><img src="https://agentmods.dev/badge/skills/lucassantana-dev/sharekit/dep-sweep.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00081 | $0.02170 |
| Opus 5 | $0.00041 | $0.01085 |
| Sonnet 5 | $0.00016 | $0.00434 |
| Haiku 4.5 | $0.00008 | $0.00217 |
Grade A, and why
dep-sweep scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 204 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dep Sweep
Turn a wall of bot PRs into one decision pass. Auto-merges the safe class
into the resolved base branch (main by default; a repo that's explicitly
opted into the release-train exception uses its configured release_branch
instead — see Resolve target below) and surfaces only the genuinely risky
updates for human review. Reduces the daily/weekly drag of "20 dependabot
PRs are open and I keep ignoring them".
Auto-invocation triggers
- User says "deal with dependabot", "clean up renovate", "update deps", "merge the bot PRs"
- ≥10 open PRs authored by
dependabot[bot],renovate[bot], orpre-commit-ci[bot] - Weekly cadence if the repo has automated dep updates configured
Risk classification (always first)
For each open bot PR, classify into one of:
Evaluate HOLD conditions first, then REVIEW, then AUTO-MERGE — a patch bump with passing CI that's also a security advisory is HOLD, not AUTO-MERGE. Security advisories never qualify for AUTO-MERGE regardless of bump size or CI status; the "safe" heuristics below only apply once HOLD is ruled out.
| Bucket | Heuristic | Default action |
|---|---|---|
| HOLD (risky) | Security advisories, OR major bumps, OR bumps that fail CI, OR dependencies listed in always_hold in .claude/dep-sweep-config.json |
Comment on PR with reason; leave open |
| REVIEW (medium) | Minor bumps of runtime deps, OR any bump that touches a known-sensitive package list (see project config) | Surface to user with diff summary |
| AUTO-MERGE (safe) | devDependencies only, OR patch bumps to any dep with passing CI, OR lockfile-only resyncs, OR pre-commit hook bumps — none of which are also a HOLD or REVIEW match | Auto-merge into the resolved target |
Sensitive package list defaults: react, next, vue, svelte, anything
matching ^@types/node$, eslint, typescript, ORM packages (prisma,
drizzle-orm, typeorm), test frameworks (vitest, jest, playwright),
bundlers (vite, webpack, turbo, rollup).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 204 lines · 81 tokens per session scan A c80eedd4e8df
dep-sweep is a skill published in the GitHub repository LucasSantana-Dev/sharekit (1 stars, last pushed 2d ago), licensed MIT. It adds 81 tokens to every session and 2,170 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
do
Work an increment task by task through the ledger: task next, claim, implement, commit, task done with evidence. Use when saying "implement", "start working", or "continue increment".
atomic-git-discipline
Compressed commit message and PR body generator. Cuts noise from both while preserving intent and reasoning. Conventional Commits format. Subject ≤50 chars, body only when "why" isn't obvious; PR bodies state only what the diff can't show, 120 words max. Use when user says "write a commit", "commit message", "generate…
commit-msg
You receive a git diff of staged changes via stdin. Generate a commit message.
aigon-research-spec-revise
Revise research spec after pending spec reviews — decide and acknowledge in one pass.
creating-issues-and-pull-requests
Use when creating GitHub pull requests or issues with template compliance. Triggers: 'create a PR', 'open a pull request', 'file an issue', 'create issue'. Also invoked by finishing-a-development-branch. NOT for: deciding whether to merge or PR (use finishing-a-development-branch).
commit
Conventional Commits 1.0 generator. Stages relevant files, infers type(scope): description, never uses --no-verify.