MockServer is a testing server and proxy that imitates APIs, records and changes network traffic, and deliberately introduces failures. It is for developers testing applications against unavailable dependencies, debugging requests, and checking how systems handle degraded services across several network protocols. The catalogue add-ons help operate, configure, and test MockServer.
Borrowing it
Nothing to install: this file belongs to mock-server/mockserver-monorepo. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/mock-server/mockserver-monorepo/master/.opencode/skills/dependabot-snyk-pr-management/SKILL.mdgit clone --depth 1 https://github.com/mock-server/mockserver-monorepoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mock-server/mockserver-monorepo/dependabot-snyk-pr-management)<a href="https://agentmods.dev/skills/mock-server/mockserver-monorepo/dependabot-snyk-pr-management"><img src="https://agentmods.dev/badge/skills/mock-server/mockserver-monorepo/dependabot-snyk-pr-management/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mock-server/mockserver-monorepo/dependabot-snyk-pr-management"><img src="https://agentmods.dev/badge/skills/mock-server/mockserver-monorepo/dependabot-snyk-pr-management.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.03273 |
| Opus 5 | $0.00028 | $0.01636 |
| Sonnet 5 | $0.00011 | $0.00655 |
| Haiku 4.5 | $0.00006 | $0.00327 |
Grade A, and why
dependabot-snyk-pr-management scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 363 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dependabot and Snyk PR Management
Interact with Dependabot and Snyk pull requests for dependency upgrades and security fixes.
When to Use
Use when:
- User asks to "rebase Dependabot PR", "merge Dependabot PR", or similar
- User asks to "update dependencies", "fix Snyk alerts", or similar
- Investigating failed dependency upgrade PRs
- Reviewing security vulnerability PRs from Snyk or Dependabot
Safety Rules
IMPORTANT: Before merging, rebasing, or closing any PR:
- Verify PR author is
app/dependabotor a Snyk bot - Check CI status (all checks must pass for merge)
- Verify javax/jakarta compatibility (see section below)
- Review changed dependencies and scope
- Never use
git add .— stage explicit files only - Never force-push to bot-owned branches without explicit user approval
Dependabot Commands
Dependabot responds to commands in PR comments. All commands are invoked via @dependabot <command>.
Response behavior: Dependabot reacts with 👍 and may take several minutes to process the command.
Common Commands
| Command | Purpose | When to Use |
|---|---|---|
@dependabot rebase |
Rebase PR onto latest base branch | When PR is behind master or needs to pick up recent fixes |
@dependabot recreate |
Close and recreate PR from scratch | When PR is in a bad state or has conflicts |
@dependabot merge |
Merge PR (if all checks pass) | To auto-merge via Dependabot (alternative: gh pr merge --auto) |
@dependabot squash and merge |
Squash and merge PR | Preferred for dependency bumps to keep history clean |
@dependabot cancel merge |
Cancel a previously requested merge | If you change your mind |
@dependabot close |
Close PR without merging | To reject an upgrade |
@dependabot reopen |
Reopen a closed PR | To reconsider a previously rejected upgrade |
@dependabot ignore this dependency |
Never upgrade this dependency | For permanently pinned dependencies |
@dependabot ignore this major version |
Skip this major version | When major version requires code changes |
@dependabot ignore this minor version |
Skip this minor version | When minor version has issues |
@dependabot ignore this patch version |
Skip this patch version | When patch version has issues |
@dependabot show <dep> ignore conditions |
Show current ignore rules for dependency | Before removing ignore rules |
@dependabot unignore <dep> |
Remove all ignore rules for dependency | Re-enable upgrades for a specific dependency |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 363 lines · 56 tokens per session scan A aec0f07e8c66
dependabot-snyk-pr-management is a skill published in the GitHub repository mock-server/mockserver-monorepo (4,969 stars, last pushed today), licensed Apache-2.0. It adds 56 tokens to every session and 3,273 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
bmad-loop
Iterate over a list of story keys, executing dev → review → PR → CI → merge for each. Use when the user says "loop these stories [list]" or "run the loop on [story keys]".
prowler-commit
Creates professional git commits following conventional-commits format. Trigger: When creating commits, after completing code changes, when user asks to commit.
gh-auth-isolation
Safely manage multiple GitHub identities (EMU + personal) in agent workflows.
github-skill
Work with GitHub via the gh CLI — clone repositories, create/list/merge pull requests, create/list issues, and run any other gh command (API calls, workflow runs, releases, repo administration). List operations return parsed JSON.
changelog-composer
Generates structured changelogs and release notes from git history and PRs, classifying breaking changes, features, fixes, performance, docs. Triggers on: "generate changelog", "write release notes", "what changed since", "prepare release", "release notes for", "diff since tag".
nvca-chart-release
Release NVCA Operator chart changes from the native monorepo source to the vendored Helm chart. Use when updating the vendored NVCA Operator chart, changing NVCA image refs, publishing helm-nvca-operator, or validating the chart against a self-managed control plane.