What is sq-site-dependabot?

A review workflow for Dependabot pull requests affecting the sq.io website and its Bun lockfile. A lockfile records the exact dependency versions used by a project, while Bun is a JavaScript runtime and package manager.

Use it to audit site dependency pull requests, run the site's CI checks, inspect Lighthouse results, validate Netlify deployments, and merge updates with consent.

It helps handle website dependency updates in order, since several updates can share the same lockfile and should be checked after each merge.

How neilotoole/sq configures Claude Code

About the project

sq is a command-line data-wrangling tool that lets users query, join, inspect, compare, and transform SQL databases and structured files such as CSV and Excel using SQL or jq-like queries. It is intended for people working with databases and tabular or document data. Catalogue add-ons provide workflows for using sq from coding agents.

neilotoole/sq · 2,564 stars · on GitHub · sq.io

Reuse

Borrowing it

Nothing to install: this file belongs to neilotoole/sq. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/neilotoole/sq/master/.agents/skills/sq-site-dependabot/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/neilotoole/sq

Made for: Claude Code.

Or install sq, the plugin that ships this one along with the rest of its 4 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/neilotoole/sq/sq-site-dependabot/github.svg)](https://agentmods.dev/skills/neilotoole/sq/sq-site-dependabot)

Your own site

<a href="https://agentmods.dev/skills/neilotoole/sq/sq-site-dependabot"><img src="https://agentmods.dev/badge/skills/neilotoole/sq/sq-site-dependabot/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/neilotoole/sq/sq-site-dependabot"><img src="https://agentmods.dev/badge/skills/neilotoole/sq/sq-site-dependabot.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 50 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,955 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 1 finding, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

high Privilege Escalation · line 117
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00050	$0.01955
Opus 5	$0.00025	$0.00978
Sonnet 5	$0.00010	$0.00391
Haiku 4.5	$0.00005	$0.00196

Measured 11d ago against content hash d5adc233d1ab, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

sq-site-dependabot scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

The scan reads SKILL.md. This mod also ships 3 executable files (scripts/check-tools.sh, scripts/debug-netlify-pr.sh, scripts/merge-next.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

Requires gh CLI (authenticated), Bun 1.2+, make, jq, curl, and network

.agents/skills/sq-site-dependabot/SKILL.md · 204 lines

How it starts

The opening of the file, as written. The whole thing — 204 lines — stays where its author put it; the contents beside it link to each section on GitHub.

sq-site-dependabot

Maintainer workflow for Dependabot PRs touching site/ or site/bun.lock. Read AGENTS.md for skill install paths.

Do not merge site Dependabot PRs in bulk without rebasing between merges (shared bun.lock).

Operating modes

Mode	Actions	Merge
Audit	List/classify; CI; ordered plan	No
Validate	Branch checkout; `make ci`	No
Full	Audit + validate + merge loop	Consent

Default to Audit unless the user says "merge", "clear them", or "full".

Phase 0 — Tool bootstrap

Run first in every mode. Stop on failure.

# gh auth + site deps (bun install if needed) + make check
.agents/skills/sq-site-dependabot/scripts/check-tools.sh
# Full / Layer B (+ NETLIFY_* via make check-netlify):
.agents/skills/sq-site-dependabot/scripts/check-tools.sh --netlify
# Or: gh api user -q .login && cd site && bun install && make check-netlify

check-tools.sh runs bun install in site/ when bun x netlify-cli is missing (fresh clone, agent sandbox). Needs network. SKIP_SITE_DEPS=1 skips that step. Layer B (site-netlify-validate) always uses bun x netlify-cli — a global/brew CLI does not replace bun install.

Details: references/tool-bootstrap.md.

Phase 1 — Discovery

From repository root:

gh pr list --author 'app/dependabot' --state open \
  --json number,title,headRefName,mergeable,statusCheckRollup,createdAt \
  --jq '.[] | select(.headRefName | test("^dependabot/"))'

Confirm each candidate touches site/ (gh pr diff <n> --name-only). Treat the list as candidates — refine by path if the filter is too broad.

For each PR:

Confirm changes are under site/.
Record mergeable state, Site CI, Netlify deploy-preview URL, Lighthouse if present.
Flag false-positive Site CI noise (external link crawl) — see references/ci-and-checks.md.

Read the full file on GitHub · 204 lines

Files

What ships with it

10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

11d ago First seen · 204 lines · 50 tokens per session scan A d5adc233d1ab

Subscribe to this mod's changes

sq-site-dependabot is a skill published in the GitHub repository neilotoole/sq (2,564 stars, last pushed yesterday), licensed MIT. It adds 50 tokens to every session and 1,955 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

CI and CD Code review DevOps and cloud Go csv excel go sql tsv

skill-creator

Create, edit, improve, or audit AgentSkills. Use when creating a new skill from scratch or when asked to improve, review, audit, tidy up, or clean up an existing skill or SKILL.md file. Also use when editing or restructuring a skill directory.

agenvoy/Agenvoy · 58 tokens

code-reviewer

Analyze project source code and generate optimization suggestions. Use when user wants code review, performance optimization advice, security hardening recommendations, or architecture improvement suggestions.

agenvoy/Agenvoy · 34 tokens

code-guidelines-go

Go 1.24–1.27 coding guidelines for the dimetron/pi-go AI agent runtime. Use this skill whenever writing, reviewing, or refactoring ANY Go code in pi-go. This covers idiomatic style, error handling, concurrency, project layout, testing (table-driven, fuzz, benchmarks, synctest), new stdlib usage, golangci-lint v2…

dimetron/pi-go · 124 tokens

design-review

Deep design review of Go codebase — naming, structure, consistency, interfaces, error handling. Scores each dimension and provides actionable fixes.

dimetron/pi-go · 30 tokens

vhs-e2e-gif

Record a test run, a TUI session, or any terminal command as a GIF with VHS and attach it to a GitHub PR as a release-hosted asset, never a repo commit. Use when asked to record an e2e run, demo a fix on a PR, attach a GIF or screen recording to a pull request, show a test passing visually, or produce a terminal…

dimetron/pi-go · 106 tokens

agents-md

Generate AGENTS.md files for Go, Rust, TypeScript, and Java projects. Use this skill whenever the user asks to create, scaffold, bootstrap, update, or review an AGENTS.md (or agent-instructions, CLAUDE.md, repo guide for agents) file in a codebase. Also trigger when the user says "add AGENTS.md", "make this repo…

dimetron/pi-go · 138 tokens

sq: Skill for Claude Code