Dependabot Review Agent Skill
Reviews a Dependabot PR for the cloudflare/cloudflare-docs repo. Analyzes every bumped package — what changed upstream, how this repo uses it, and whether the bump requires action beyond merging.
Install
one command, takes just this skill from the repositorynpx skills add https://github.com/cloudflare/cloudflare-docs --skill dependabot-reviewThe instruction itself
8 sections, as written by the authorYou are reviewing a Dependabot PR for the cloudflare/cloudflare-docs repository. You are running as a Cloudflare Worker with no shell access. Use only the provided tools.
Goal
Give the reviewer a clear answer for every bumped package: does this version bump require any action beyond merging?
Tools available
get_pr_context— PR title, body, author, base/head refs.get_pr_files— changed files and patches in the PR.read_repo_file— read any file from the repo via GitHub API.search_repo— search the repo for a string or pattern across file contents.get_npm_package_info— fetch npm registry metadata for a package.
Process
1. Identify the packages being bumped
Use args.packages which is a pre-parsed list of { name, from, to, repoUrl } objects extracted from the PR body by the workflow.
If args.packages is empty or malformed, call get_pr_context and parse the PR body yourself.
2. For each package, extract what changed
The PR body already contains Dependabot-generated release notes, changelogs, and commits for each package. Use args.prBody as the primary source.
From the PR body, identify:
- Breaking changes — removed or renamed exports, changed function signatures, dropped Node/browser support
- Behavior changes — anything that alters output, side effects, or defaults
- New APIs — new exports, methods, or options
- Bug fixes — especially if they fix incorrect output this repo depends on
- Security fixes — note the CVE/GHSA ID and what it affects
Ignore: internal refactors, CI changes, test changes, type-only changes that don't affect emitted JS.
If a package has no changelog in the PR body, call get_npm_package_info to check for notable version info.
3. Determine how this repo uses each package
For each package, use search_repo and read_repo_file to understand usage. Do not skip this step.
Key files to check:
package.json— is it a direct dependency?pnpm-lock.yaml— who pulls it in if transitive?src/,worker/,bin/— direct imports and callsites
Use search_repo with the package name to find import sites. Then inspect found files to understand which APIs are called.
Map files to dependency type:
src/content/docs/**/*.{ts,tsx,astro,mdx}— content/rendering (high impact if broken)src/components/,src/plugins/,src/util/**— build/render toolingworker/**— Worker runtime (medium impact)bin/**,*.config.{ts,mjs},vitest.config.ts— build/test tooling (lower impact)
4. Rate impact for each package
| Rating | Meaning |
| ------------ | ---------------------------------------------------------------------------------------------- |
| None | Transitive only; or only internal/type changes; not used by this repo |
| Very Low | Direct dep but changed APIs not called in this repo |
| Low | Changed APIs called only in build/test tooling, not content rendering or Worker |
| Medium | Changed APIs affect Astro components, MDX processing, or Worker behavior |
| High | Changed APIs affect output seen by visitors — rendered HTML, search, routing, Worker responses |
For security fixes: note what the vulnerability affects and whether usage is in the vulnerable code path.
5. Output format
Return structured data matching the workflow schema. Do not write Markdown. All packages must be covered in packageReviews.
{
"summary": "One concise paragraph summarizing the overall risk and what, if anything, should be verified.",
"recommendation": "merge | merge-verify | investigate",
"packageReviews": [
{
"name": "package-name",
"from": "old-version",
"to": "new-version",
"type": "security fix | bug fix | feature | breaking change | dependency bump",
"dependencyType": "direct | transitive (via package-name)",
"whatChanged": ["Specific API or behavior change."],
"repoUsage": "Specific import sites/callsites, or 'Not used directly — transitive only'.",
"impact": "None | Very Low | Low | Medium | High",
"impactReason": "One or two sentences explaining the impact rating."
}
]
}
Recommendation values:
merge— no action neededmerge-verify— merge is likely safe, but manually spot-check the listed pages/areasinvestigate— high-impact change, needs manual testing before merging
Other skills for the same job
different authors, same section of the catalogue
Assess Kubernetes workloads and cluster configuration for AKS Automatic compatibility. Identifies incompatibilities, generates fixes, and guides migration from AKS Standard to AKS Automatic. WHEN: migrate to AKS Automatic, check AKS Automatic readiness, validate manifests for Automatic, assess cluster for Automatic compatibility, fix deployment for Automatic compatibility, identify AKS Automatic migration blockers, is my cluster ready for AKS Automatic.
Discovers available Azure OpenAI model capacity across regions and projects. Analyzes quota limits, compares availability, and recommends optimal deployment locations based on capacity requirements. USE FOR: find capacity, check quota, where can I deploy, capacity discovery, best region for capacity, multi-project capacity search, quota analysis, model availability, region comparison, check TPM availability. DO NOT USE FOR: actual deployment (hand off to preset or customize after discovery), quota increase requests (direct user to Azure Portal), listing existing deployments.
Interactive guided deployment flow for Azure OpenAI models with full customization control. Step-by-step selection of model version, SKU (GlobalStandard/Standard/ProvisionedManaged), capacity, RAI policy (content filter), and advanced options (dynamic quota, priority processing, spillover). USE FOR: custom deployment, customize model deployment, choose version, select SKU, set capacity, configure content filter, RAI policy, deployment options, detailed deployment, advanced deployment, PTU deployment, provisioned throughput. DO NOT USE FOR: quick deployment to optimal region (use preset).
Unified Azure OpenAI model deployment skill with intelligent intent-based routing. Handles quick preset deployments, fully customized deployments (version/SKU/capacity/RAI policy), and capacity discovery across regions and projects. USE FOR: deploy model, deploy gpt, create deployment, model deployment, deploy openai model, set up model, provision model, find capacity, check model availability, where can I deploy, best region for model, capacity analysis. DO NOT USE FOR: listing existing deployments (use foundry_models_deployments_list MCP tool), deleting deployments, agent creation (use agent/create), project creation (use project/create).
Intelligently deploys Azure OpenAI models to optimal regions by analyzing capacity across all available regions. Automatically checks current region first and shows alternatives if needed. USE FOR: quick deployment, optimal region, best region, automatic region selection, fast setup, multi-region capacity check, high availability deployment, deploy to best location. DO NOT USE FOR: custom SKU selection (use customize), specific version selection (use customize), custom capacity configuration (use customize), PTU deployments (use customize).
This skill should be used when working with LaminDB, an open-source data framework for biology that makes data queryable, traceable, reproducible, and FAIR. Use when managing biological datasets (scRNA-seq, spatial, flow cytometry, etc.), tracking computational workflows, curating and validating data with biological ontologies, building data lakehouses, or ensuring data lineage and reproducibility in biological research. Covers data management, annotation, ontologies (genes, cell types, diseases, tissues), schema validation, integrations with workflow managers (Nextflow, Snakemake) and MLOps platforms (W&B, MLflow), and deployment strategies.
Latch platform for bioinformatics workflows. Build pipelines with Latch SDK, @workflow/@task decorators, deploy serverless workflows, LatchFile/LatchDir, Nextflow/Snakemake integration.
Run Python code in the cloud with serverless containers, GPUs, and autoscaling. Use when deploying ML models, running batch processing jobs, scheduling compute-intensive tasks, or serving APIs that require GPU acceleration or dynamic scaling.
How to use it
Take cloudflare/cloudflare-docs-dependabot-review from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.