Dependabot Alert Review Skill

dependabot-alert-review

An [Agent Skill](https://www.skills.sh/) that triages a GitHub Dependabot vulnerability alert before any fix PR exists, judging whether it's actually exploitable in your codebase rather than just how high its CVSS score is.

Security update PRs are a separate opt in setting from version update PRs, and there's no way to generate one on demand, so an alert can sit open with nothing to review yet. This skill fills that gap. It checks whether a fix is already in flight, and it assesses real reachability, meaning whether attacker controlled input actually reaches the vulnerable code path in your code, not just whether the package happens to be imported somewhere. It also cross references the advisory against OSV.dev and CISA's Known Exploited Vulnerabilities catalog, and, only when you explicitly ask, it drafts a remediation plan for you to approve before anything gets touched.

**It never commits, pushes, or opens a PR itself.** Even in fix mode, once you approve a plan, it only edits local files. You review the diff and handle every git and GitHub action yourself, always. The only exception is dismissing an alert, and even that only happens when you explicitly ask for it.

If a PR already exists for the alert, it hands off to its sibling skill, [`dependabot-review`](https://github.com/iamravenous/dependabot-review-skill), for the actual PR level review. That's a different job, and this skill doesn't duplicate it.

Install

The [skills](https://www.skills.sh/) CLI installs it and wires it up for your agent automatically.

npx skills add iamravenous/dependabot-alert-review-skill

It also accepts a full repository URL, if you'd rather not rely on the GitHub shorthand form.

npx skills add https://github.com/iamravenous/dependabot-alert-review-skill

Manual install (no CLI)

Clone the repo and drop it straight into your skills directory. For Claude Code, that's `.claude/skills/` for a project, or `~/.claude/skills/