The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill creates GitHub Action workflows that reference and execute the pradeepmouli/dependabit action. This is a vendor-owned resource originating from the same author as the skill.
[COMMAND_EXECUTION]: The provided workflow templates execute shell commands to manage Git configurations and push the generated dependency manifest back to the repository (git commit, git push).
[PROMPT_INJECTION]: The skill establishes a workflow for processing untrusted external data, creating a surface for indirect prompt injection.
- Ingestion points: Scans repository source files (Markdown, TypeScript, Python, etc.) and navigates to external URLs found within those files (documentation sites, research papers).
- Boundary markers: No specific boundary markers or 'ignore' instructions for the LLM are present in the configuration templates; such logic is likely handled within the external action code.
- Capability inventory: The workflows are granted contents: write, issues: write, and pull-requests: write permissions, allowing the agent to modify the repo and create issues based on its findings.
- Sanitization: Sanitization or validation of the content fetched from external URLs is not explicitly defined in the skill's static assets.

dependabit-bootstrap