Dependabot Skill

A Claude Code skill that fetches open Dependabot security alerts for a GitHub repository, then reviews and updates vulnerable dependencies.

What it does

When you run /dependabot, the skill:

1. Checks which GitHub accounts are available via the gh CLI and lets you pick one
2. Fetches all open Dependabot alerts for the target repository
3. Reviews each alert — package name, severity, vulnerable version range, and available patch
4. Updates the vulnerable dependencies using the project's package manager
5. Verifies the build and tests still pass
6. Reports a summary of what was fixed

Usage

/dependabot                         # uses the current repo's git remote
/dependabot wjgilmore my-project    # targets a specific owner/repo

If you don't provide arguments, the skill infers the owner and repo from the origin git remote.

Prerequisites

You need the GitHub CLI (gh) installed and authenticated. Your token must include the security_events scope:

gh auth login
gh auth refresh -h github.com -s security_events

If you have multiple gh accounts, the skill will ask which one to use before running.

How it works under the hood

The skill runs a shell script (dependabot.sh) that calls the GitHub API to fetch each Dependabot alert individually. It collects the alert number, severity, package name, ecosystem, vulnerable version range, patched version, and manifest file into a JSON array. Claude then reads that output, figures out which packages to update, runs the appropriate package manager commands, and confirms everything still builds.