# Get Pr Dependency Advisories

> Scan changed dependency manifests in a PR and query GitHub Advisory Database for discovered dependencies automatically.

- Skill: `sasky80/get-pr-dependency-advisories` (Agent Skill)
- Install (CLI): `npx skillmds@latest add sasky80/get-pr-dependency-advisories`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sasky80/get-pr-dependency-advisories/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: sasky80 (https://skillmd.com/u/sasky80)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/sasky80/get-pr-dependency-advisories

---


# Get PR Dependency Advisories

## Platform Note

- Clean-install path: use the Go command from `.github/tools/skills-go`.

## Authentication

- Azure DevOps PAT: `ADO_PAT_<normalized_org>`
- GitHub PAT: `GH_SEC_PAT`

## What it does

1. Resolves source branch from PR metadata.
2. Finds changed dependency manifest files in the selected PR iteration.
3. Extracts dependencies from supported manifests.
4. Queries `https://api.github.com/advisories` for each dependency.
5. Returns one consolidated JSON report.

## Supported changed manifests

- `package.json` (`dependencies`, `devDependencies`, `optionalDependencies`, `peerDependencies`)
- `package-lock.json`
- `requirements.txt`
- `requirements-dev.txt`
- `poetry.lock`
- `go.mod`
- `Cargo.lock`

## Arguments

| # | Name | Required | Description |
|---|------|----------|-------------|
| 1 | organization | Yes | Azure DevOps organization |
| 2 | project | Yes | Project name or ID |
| 3 | repositoryId | Yes | Repository name or ID |
| 4 | pullRequestId | Yes | Pull request ID |
| 5 | iterationId | No | PR iteration ID (defaults to latest) |
| 6 | per_page | No | Max advisories per dependency query (1..100, default: 20) |

## Examples

```bash
go run ./.github/tools/skills-go/cmd/skills-go get-pr-dependency-advisories myorg MyProject MyRepo 42
```

## Output

Returns compact JSON with:

- `manifestFiles`
- `dependencies`
- `advisories`
- `dependenciesChecked`
- `advisoriesFound`
- `highOrCritical`