How do I install the Prepare Dependabot Prs skill?

Run npx skillmds@latest add help-me-mom/prepare-dependabot-prs in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Prepare Dependabot Prs safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Prepare Dependabot Prs?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Prepare Dependabot Prs free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Prepare Dependabot Prs?

help-me-mom (@help-me-mom) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Prepare Dependabot Prs by help-me-mom

Name: Prepare Dependabot Prs
Author: help-me-mom

Prepare Dependabot Prs

Use when preparing GitHub Dependabot pull requests by listing open PRs, verifying they are authored by app/dependabot, closing package.json major-version updates, and enabling auto-merge and approval for eligible updates without merging manually.

help-me-mom 88762c0 3.0 KB Updated Sep 17, 2026

File contents

Prepare Dependabot PRs

Use this skill for repetitive Dependabot PR preparation in this repository.

Task List

Use a plain Markdown checklist so the workflow is easy to follow in AI Agent:

- [ ] Confirm GitHub auth and list open Dependabot PRs in the upstream repository
- [ ] Verify authors, changed files, and package.json version changes
- [ ] Close every PR containing a package.json major-version change
- [ ] Enable auto-merge with squash for each remaining eligible PR
- [ ] Approve each remaining eligible PR
- [ ] Summarize prepared PRs and any blockers

Workflow

Confirm GitHub CLI access.
List open PRs authored by app/dependabot in help-me-mom/ng-mocks.
Verify each candidate's author and changed files.
Inspect every changed package.json. Compare the before and after versions in all dependency declarations. Treat the PR as a major-version update when any dependency's SemVer major number changes.
Close each major-version update. Do not enable auto-merge or approve it.
Enable auto-merge with squash for each remaining eligible PR.
Approve each remaining eligible PR.
Report prepared and closed PRs, plus any PRs skipped because of missing permissions, unexpected changes, ambiguous versions, or policy blockers.

Commands

REPO=help-me-mom/ng-mocks

gh auth status
gh pr list --repo "$REPO" --author app/dependabot --state open --json number,title,url,headRefName
gh pr view <pr-number> --repo "$REPO" --json author,files,title,url
gh api --paginate "repos/$REPO/pulls/<pr-number>/files" --jq '.[] | select(.filename | endswith("package.json")) | {filename,patch}'
gh pr close <pr-number> --repo "$REPO"
gh pr merge <pr-number> --repo "$REPO" --auto --squash
gh pr review <pr-number> --repo "$REPO" --approve
gh pr view <pr-number> --repo "$REPO" --json state,autoMergeRequest,reviews

Validation

Confirm every detected major-version update is closed.
Confirm each prepared PR shows auto-merge enabled.
Confirm each prepared PR has an approval from the current reviewer.

Guardrails

Do not merge PRs manually; this skill only prepares them for CI-driven auto-merge.
Skip any PR that is not clearly a Dependabot dependency update.
Never enable auto-merge or approve a PR when any dependency changes SemVer major in a package.json.
If a changed version is ambiguous or a package.json patch is unavailable or truncated, do not assume eligibility; retrieve the base and head file contents or stop and report the blocker.
Always target help-me-mom/ng-mocks; do not default to the checkout's origin remote.
If branch protection, reviewer rules, or GitHub permissions block the workflow, stop and report the blocker.

---name: prepare-dependabot-prsdescription: Use when preparing GitHub Dependabot pull requests by listing open PRs, verifying they are authored by app/dependabot, closing package.json major-version updates, and enabling auto-merge and approval for eligible updates without merging manually.---# Prepare Dependabot PRsUse this skill for repetitive Dependabot PR preparation in this repository.## Task ListUse a plain Markdown checklist so the workflow is easy to follow in AI Agent:```md- [ ] Confirm GitHub auth and list open Dependabot PRs in the upstream repository- [ ] Verify authors, changed files, and package.json version changes- [ ] Close every PR containing a package.json major-version change- [ ] Enable auto-merge with squash for each remaining eligible PR- [ ] Approve each remaining eligible PR- [ ] Summarize prepared PRs and any blockers```## Workflow1. Confirm GitHub CLI access.2. List open PRs authored by `app/dependabot` in `help-me-mom/ng-mocks`.3. Verify each candidate's author and changed files.4. Inspect every changed `package.json`. Compare the before and after versions in all dependency declarations. Treat the PR as a major-version update when any dependency's SemVer major number changes.5. Close each major-version update. Do not enable auto-merge or approve it.6. Enable auto-merge with squash for each remaining eligible PR.7. Approve each remaining eligible PR.8. Report prepared and closed PRs, plus any PRs skipped because of missing permissions, unexpected changes, ambiguous versions, or policy blockers.## Commands```bashREPO=help-me-mom/ng-mocksgh auth statusgh pr list --repo "$REPO" --author app/dependabot --state open --json number,title,url,headRefNamegh pr view <pr-number> --repo "$REPO" --json author,files,title,urlgh api --paginate "repos/$REPO/pulls/<pr-number>/files" --jq '.[] | select(.filename | endswith("package.json")) | {filename,patch}'gh pr close <pr-number> --repo "$REPO"gh pr merge <pr-number> --repo "$REPO" --auto --squashgh pr review <pr-number> --repo "$REPO" --approvegh pr view <pr-number> --repo "$REPO" --json state,autoMergeRequest,reviews```## Validation- Confirm every detected major-version update is closed.- Confirm each prepared PR shows auto-merge enabled.- Confirm each prepared PR has an approval from the current reviewer.## Guardrails- Do not merge PRs manually; this skill only prepares them for CI-driven auto-merge.- Skip any PR that is not clearly a Dependabot dependency update.- Never enable auto-merge or approve a PR when any dependency changes SemVer major in a `package.json`.- If a changed version is ambiguous or a `package.json` patch is unavailable or truncated, do not assume eligibility; retrieve the base and head file contents or stop and report the blocker.- Always target `help-me-mom/ng-mocks`; do not default to the checkout's `origin` remote.- If branch protection, reviewer rules, or GitHub permissions block the workflow, stop and report the blocker.

Frequently asked questions