A workflow for handling Dependabot security alerts, which report known vulnerable software dependencies. It analyses an alert, applies a fix, and prepares a branch, commit, and pull request using a CVE or GHSA identifier instead of the alert's local number.

Use it to inspect a Dependabot alert, identify the relevant vulnerability, create a working branch, apply the dependency fix, run the required checks, and open a pull request.

It makes dependency vulnerability fixes consistent and avoids putting repository-specific alert numbers into public branch names or review text. It also requires fetching the alert details before changing code.

How Taketo-Yoda/uv-sbom configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to Taketo-Yoda/uv-sbom. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/Taketo-Yoda/uv-sbom/develop/.claude/skills/dependabot/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/Taketo-Yoda/uv-sbom

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/taketo-yoda/uv-sbom/dependabot/github.svg)](https://agentmods.dev/skills/taketo-yoda/uv-sbom/dependabot)

Your own site

<a href="https://agentmods.dev/skills/taketo-yoda/uv-sbom/dependabot"><img src="https://agentmods.dev/badge/skills/taketo-yoda/uv-sbom/dependabot/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/taketo-yoda/uv-sbom/dependabot"><img src="https://agentmods.dev/badge/skills/taketo-yoda/uv-sbom/dependabot.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 12 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,506 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00012	$0.01506
Opus 5	$0.00006	$0.00753
Sonnet 5	$0.00002	$0.00301
Haiku 4.5	$0.00001	$0.00151

Measured 6d ago against content hash b4d2744ae5f8, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

dependabot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/dependabot/SKILL.md · 241 lines

How it starts

The opening of the file, as written. The whole thing — 241 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/dependabot - Security Alert Handling Skill

Handle Dependabot security vulnerability alerts with a standardized workflow, from alert analysis to PR submission.

Language Requirement

IMPORTANT: All outputs (commits, PRs) MUST be written in English.

Critical Restrictions

Alert Number Usage - PROHIBITED

Dependabot alert numbers MUST NOT appear in any of the following:

Branch names
Commit messages
PR titles
PR bodies

Reason: Alert numbers are repository-specific and not readable by third parties. Use standard identifiers instead.

Standard Identifiers - REQUIRED

Use these identifiers in order of priority:

Priority	Identifier	Format	Example
1 (Primary)	CVE ID	`CVE-YYYY-NNNNN`	`CVE-2026-25541`
2 (Fallback)	GHSA ID	`GHSA-xxxx-xxxx-xxxx`	`GHSA-434x-w66g-qw3r`

Use GHSA only when CVE is not available.

Workflow Overview

Alert Analysis → Branch Creation → Fix Application → Commit → PR Creation

Steps

Step 1: Fetch Alert Details (MANDATORY)

gh api repos/{owner}/{repo}/dependabot/alerts/{alert_number}

Extract the following information:

Field	JSON Path	Description
CVE ID	`.security_advisory.cve_id`	Primary identifier
GHSA ID	`.security_advisory.ghsa_id`	Fallback identifier
Package	`.security_vulnerability.package.name`	Affected package
Severity	`.security_vulnerability.severity`	low/medium/high/critical
Vulnerable Range	`.security_vulnerability.vulnerable_version_range`	Affected versions
Fixed Version	`.security_vulnerability.first_patched_version.identifier`	Target version
Summary	`.security_advisory.summary`	Vulnerability description

Step 2: Analyze Vulnerability

Determine the fix approach:

Scenario	Approach
Dependency update resolves	Run `cargo update -p <package>`
Code changes required	Implement necessary fixes
Breaking changes in fix	Evaluate and document migration

Read the full file on GitHub · 241 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

6d ago First seen · 241 lines · 12 tokens per session scan A b4d2744ae5f8

Subscribe to this mod's changes

dependabot is a skill published in the GitHub repository Taketo-Yoda/uv-sbom (6 stars, last pushed yesterday), licensed MIT. It adds 12 tokens to every session and 1,506 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.

Python Security sbom sbom-generator sbom-tool uv

python

Use when the task is Python itself, in any framework or none: PEP 695 generics, mypy --strict typing, dataclass/Protocol/TypedDict/Enum choices, asyncio.TaskGroup, stdlib idioms, src/ layout + pyproject.toml with uv, ruff+mypy+pytest gate. NOT a FastAPI/ASGI service (that is fastapi), NOT a deep pytest suite (that is…

ericrisco/rsc-harness · 94 tokens

uv-sbom: Skill for Claude Code