Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add LucasSantana-Dev/sharekit --skill dep-sweepgit clone --depth 1 https://github.com/LucasSantana-Dev/sharekitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lucassantana-dev/sharekit/dep-sweep)<a href="https://agentmods.dev/skills/lucassantana-dev/sharekit/dep-sweep"><img src="https://agentmods.dev/badge/skills/lucassantana-dev/sharekit/dep-sweep/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lucassantana-dev/sharekit/dep-sweep"><img src="https://agentmods.dev/badge/skills/lucassantana-dev/sharekit/dep-sweep.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00081 | $0.02170 |
| Opus 5.5 | $0.00032 | $0.00868 |
| Sonnet 5.5 | $0.00016 | $0.00434 |
| Haiku 4.5 | $0.00008 | $0.00217 |
Grade A, and why
dep-sweep scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 204 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dep Sweep
Turn a wall of bot PRs into one decision pass. Auto-merges the safe class
into the resolved base branch (main by default; a repo that's explicitly
opted into the release-train exception uses its configured release_branch
instead — see Resolve target below) and surfaces only the genuinely risky
updates for human review. Reduces the daily/weekly drag of "20 dependabot
PRs are open and I keep ignoring them".
Auto-invocation triggers
- User says "deal with dependabot", "clean up renovate", "update deps", "merge the bot PRs"
- ≥10 open PRs authored by
dependabot[bot],renovate[bot], orpre-commit-ci[bot] - Weekly cadence if the repo has automated dep updates configured
Risk classification (always first)
For each open bot PR, classify into one of:
Evaluate HOLD conditions first, then REVIEW, then AUTO-MERGE — a patch bump with passing CI that's also a security advisory is HOLD, not AUTO-MERGE. Security advisories never qualify for AUTO-MERGE regardless of bump size or CI status; the "safe" heuristics below only apply once HOLD is ruled out.
| Bucket | Heuristic | Default action |
|---|---|---|
| HOLD (risky) | Security advisories, OR major bumps, OR bumps that fail CI, OR dependencies listed in always_hold in .claude/dep-sweep-config.json |
Comment on PR with reason; leave open |
| REVIEW (medium) | Minor bumps of runtime deps, OR any bump that touches a known-sensitive package list (see project config) | Surface to user with diff summary |
| AUTO-MERGE (safe) | devDependencies only, OR patch bumps to any dep with passing CI, OR lockfile-only resyncs, OR pre-commit hook bumps — none of which are also a HOLD or REVIEW match | Auto-merge into the resolved target |
Sensitive package list defaults: react, next, vue, svelte, anything
matching ^@types/node$, eslint, typescript, ORM packages (prisma,
drizzle-orm, typeorm), test frameworks (vitest, jest, playwright),
bundlers (vite, webpack, turbo, rollup).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 204 lines · 81 tokens per session scan A c80eedd4e8df
dep-sweep is a skill published in the GitHub repository LucasSantana-Dev/sharekit (1 stars, last pushed 4d ago), licensed MIT. It adds 81 tokens to every session and 2,170 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
autofix-pr
Watch a pull request and fix it from a worktree of its own - CI failures, review feedback from trusted authors and merge conflicts are fixed, pushed to the PR branch and answered on the PR under the user's git and gh identity. Usage - /autofix-pr [ | ] [--once] [--every ] [--no-reply] [--yes] [instructions]…
cw-land
Use when turning verified Codewhale work into commits, branches, or a merge: choosing direct-main vs. worktree vs. integration branch, preserving contributor credit, and honoring the gate artifact before merging.
git-commit
Analyze changes with Git only and auto-generate conventional commit messages with optional emoji; suggests splitting commits when needed, runs local Git hooks by default (use --no-verify to skip).
git-master
MUST USE for ANY git operations: atomic commits, rebase/squash/fixup, and history search (blame, bisect, log -S, reflog). Load it before running git yourself, or pass loadskills=['git-master'] to the task that commits. Triggers: 'commit', 'rebase', 'squash', 'who wrote', 'when was X added', 'find the commit that'.
atmos-git
Atmos Git and GitOps: git.repositories, clone/pull/status/diff/commit/push/clean, local Git hook shims and hook env vars, pre-commit framework migration, Starlark git.sandbox checks and unstaged fixes, signed commits, managed workdirs, fork-PR trust gate (clone gate and posting gate), and auth via identities or…
conventional-commit
Conventional Commit - Generate Conventional Commits 1.0.0 compliant messages. MANDATORY for all git commits. Invoke when user says 'commit', 'commit this', or asks to commit code.