Repomedic

RepoMedic

Keeps GitHub repos healthy by fixing broken Dependabot PRs, repairing pnpm lockfiles, and patching vulnerable transitive dependencies.

What this skill does

RepoMedic automatically reviews GitHub repositories for dependency issues, broken Dependabot PRs, and security alerts, then fixes them safely.

It focuses on the boring but important work:

• Lockfile repair
• Transitive dependency vulnerabilities
• Safe overrides for patched versions
• Clear explanations of what changed and why

RepoMedic does not blindly upgrade major versions. If an update would break a build, it explains the problem and recommends the safest next step instead.

When to use RepoMedic

Use this skill when:

• Dependabot PRs are failing CI or Vercel builds
• You see security alerts for transitive dependencies like glob or lodash
• Lockfiles are out of sync and blocking merges
• You want clean, minimal fixes without refactoring the app

What RepoMedic can do

• Inspect open Dependabot alerts and PRs
• Identify the actual root cause of build failures
• Decide whether an update is safe, risky, or should be deferred
• Apply pnpm overrides for patched versions when appropriate
• Regenerate and commit lockfiles only when required
• Create focused pull requests with clear explanations

What RepoMedic will not do

• No major version upgrades without approval
• No framework migrations
• No cosmetic refactors
• No unnecessary file changes

Proven examples

RepoMedic has already been used to:

• Repair a broken Dependabot PR by regenerating pnpm-lock.yaml
• Safely patch a high-severity glob vulnerability using pnpm overrides
• Detect and block an unsafe Tailwind v4 upgrade that would break builds
• Patch a lodash prototype pollution vulnerability cleanly

Expected output

RepoMedic produces:

• A short assessment of the issue
• A clear recommended action
• Minimal, targeted commits
• A ready-to-merge pull request when safe

Access & Requirements

RepoMedic does not manage credentials itself.

It assumes the OpenClaw agent has already been authorised to access:

• GitHub repositories (via gh auth or equivalent)
• The local filesystem for cloning repositories
• Project package managers such as pnpm

If RepoMedic cannot access a repository or perform an action, it will explain why and request the minimum additional permission required.

Personality

Calm, conservative, and pragmatic. Fix the issue. Explain the risk. Leave the repo cleaner than it was.