Dependency management

Automatically fetch and fix Dependabot security alerts by querying GitHub REST API for open alerts, identifying vulnerable packages, researching secure versions, and updating package.json files…

livesession/xyd

Inspect, review or triage GitHub Code Scanning alerts, including CodeQL findings; apply verified dismissals when authorized.

netdata/netdata

GitHub Actions CI/CD pipeline configuration for Golang projects — workflow files for test, lint, SAST, coverage and vulnerability-scan jobs, Dependabot and Renovate config files, GoReleaser release…

samber/cc-skills-golang

Sweep and update every dependency surface in the kubelb repo (go.mod, Makefile tool versions, prow images, GitHub Actions, hack/ci pins, addon Helm charts, pinned container images) and split the…

kubermatic/kubelb

Comprehensively diagnose and fix a failing Dependabot PR. An agent skill from axsaucedo/kaos.

axsaucedo/kaos

Triage a host that was blocked by the Dependabot proxy egress allowlist, add it to internal/handlers/egressallowlistdefaults.yaml with the correct matching form and regression tests, and open a pull…

dependabot/proxy

Applies safer package manager defaults and dependency vetting to JavaScript and TypeScript projects to reduce supply-chain attack risk.

bodadotsh/npm-security-best-practices

Babysit a Dependabot dependency-bump PR all the way to merge: verify the author is the genuine Dependabot bot, diagnose and resolve any CI failure (excluding or fixing a breaking bump when needed)…

dyoshikawa/rulesync

Add BestieTemplate features (AGENTS.md, changelog, dependabot, pre-commit, lint workflow, testitem runner) to a Julia package with the bestie CLI — no Julia needed.

JuliaBesties/BestieTemplate.jl

A skill your agent uses when running a compatibility/parity AUDIT — enumerating where nub diverges from a reference it claims parity with (pnpm CLI grammar, a lockfile format, a Node behavior, a…

nubjs/nub

Triage the GitHub privately-reported vulnerability backlog for Activepieces — pull repository security advisories from the Security tab, scope-check against SECURITY.md, deeply validate each…

activepieces/activepieces

Plans a WxJava version upgrade, checking the BOM, module dependencies, JDK version and configuration, with phased steps and clear rollback conditions.

binarywang/WxJava

Looks up Kotlin Multiplatform libraries, their latest stable versions, Gradle coordinates and verified target support through klibs.io instead of guessing.

JetBrains/klibs-io

Package and publish Python libraries and CLI tools: project layout, pyproject.toml, build backends, wheels and source distributions, versioning and PyPI releases.

wshobson/agents

CI/CD with GitHub Actions for Golang — testing, linting, SAST, security scanning, coverage, Dependabot, Renovate, GoReleaser, release pipelines.

context-labs/whip

Bumps the pinned Quarto version across the RStudio repository, mirrors the release to the rstudio-buildtools S3 bucket, verifies it and opens a PR, on macOS and Linux.

rstudio/rstudio

Bumps the databricks-sdk-go dependency in the Databricks CLI together with its pinned OpenAPI spec SHA, then regenerates the files that depend on them.

databricks/cli

Fix broken dependency update PRs and aggregate the ones that work into one PR.

microsoft/vs-validation

Verifies that a pom.xml change did not silently alter Maven build behavior by diffing the effective POMs before and after.

christian-schlichtherle/truelicense

Safely update Txtify dependencies or resolve Dependabot alerts.

lkmeta/txtify

Looks up a third-party library's current documentation through the context7 MCP server instead of relying on the agent's possibly outdated training data.

duckbugio/flock

Review, apply, verify, or merge gocron dependency updates from Dependabot or manual requests.

gocronx-team/gocron

Operate the skills-manager CLI — manage a local skill hub (install, import, distribute to agents/projects, update) and backfill provenance for source-less skills (adopt lockfile evidence, search the…

shenysun/skills-manager

Fix every open Dependabot PR end-to-end on autopilot. An agent skill from axsaucedo/kaos.

axsaucedo/kaos

Guides writing, running and configuring Deno 2.9+ projects: installing npm and JSR dependencies, permissions, config file precedence and the built-in fmt, lint, test and compile toolchain.

denoland/skills

Conventions for the opentrons-ai-server FastAPI service — project structure, uv dependency management, settings, testing, Docker, and deployment.

Opentrons/opentrons

Update the Skia graphics library to a new Chrome milestone in SkiaSharp's mono/skia fork.

mono/SkiaSharp

Sets one monorepo's rules for toolchain pins, pnpm package operations, the shared dependency catalog and moon tasks, so the agent adds versions and scripts the right way.

pierrecomputer/pierre

Read every open Dependabot PR for an application-code dependency (Python pip/uv and JS npm/yarn/pnpm) and carry each version bump over to the local dependency files (requirements.txt…

ossf/oss-crs

Hermetic Bazel build, test, and packaging commands for the Moosync project.

Moosync/Moosync

Updates the default serverless environment version in Databricks CLI bundle templates together with its coupled Python and DB Connect pins.

databricks/cli

审计 Node.js、Python、Go、Rust、JVM、Ruby 项目的依赖漏洞、版本健康度与许可证事实；当用户要求检查 package.json、lockfile、requirements、go.mod、Cargo.toml、pom.xml、Gemfile.lock，或生成不改依赖的中文审计报告时使用

laolaoshiren/claude-code-skills-zh

Bumps the dbt-artifacts-parser package semver, prepares a PyPI release, and aligns GitHub Releases with version.

yu-iskw/dbt-artifacts-parser

Audit repo dependencies by default and only apply library upgrades when explicitly requested.

championswimmer/TwoFac

Updates chosen or all Nix flake inputs, checks the result with nix flake check and a system rebuild, fixes warnings, then offers to commit.

Ruixi-rebirth/flakes

Points the agent at Bun 1.4 built-in APIs before it installs an npm package, so image, browser, markdown, cron, PTY and test work uses what Bun already ships.

code-yeongyu/senpi

Checks deps update in widely consumed repos will cause problems or not, and ranks dependency updates by downstream impact for prioritisation.

cultureamp/kaizen-design-system

A skill your agent uses for Dependabot PRs, dependency bumps, Gradle or Maven dependency updates, GitHub Actions updates, dependency changelog/licence/release-note review, JVM/classfile checks, and…

kernitus/BukkitOldCombatMechanics

A skill your agent uses when working on CI workflows, GitHub Actions, release process, changelog generation (git-cliff), or dependabot configuration.

kattouf/Sake

Add a format-specific resolver to GitWand core. An agent skill from devlint/GitWand.

devlint/GitWand

Active runtime recovery for coding agents: when something breaks mid-task, diagnose the root cause, write a fix, VERIFY by re-running the broken thing, then file a HEAL- entry to .learnings/HEALS.md…

pskoett/pskoett-ai-skills

Audits outdated npm and Bun packages for supply chain integrity before bumping them, deferring risky ones and logging every decision.

backnotprop/plannotator

Apply the changes from all open Renovate bot pull requests of a GitHub repository into the local working tree.

sivaprasadreddy/sivalabs-agent-skills

Dependency management for Golang projects — go.mod and go.sum, go get install and upgrade flows, Minimal Version Selection, conflict resolution with replace/exclude/retract, govulncheck scanning of…

samber/cc-skills-golang

Gathers security findings from Dependabot, GCP container scanning, Docker Scout and Linear security issues, then triages and remediates them across Warp's repos and images.

warpdotdev/warp

Secure dependency upgrades with supply chain protection, cooldowns, and staged rollout.

secondsky/sap-skills

Scans package manifests and lockfiles for outdated packages and known CVEs, then classifies each possible update as patch, minor, major or escalate-human for a dependency sweeper loop.

cobusgreyling/loop-engineering

A skill your agent uses when bumping any dependency, upgrading the HA test harness (pytest-homeassistant-custom-component) or HA floor, or handling Dependabot PRs/security alerts — per-package pin…

cognitivegears/ha-escpos-thermal-printer