An auto-merge workflow on pull_request_target that checks if: github.actor == 'dependabot[bot]' can merge an attacker's pull request, because github.actor is whoever caused the last event, not who opened the pull request. A registry token pasted into dependabot.yml or renovate.json is readable by everyone with the repository. A dependabot.yml with package-ecosystem: "yarn" is rejected, and the updates you expect never arrive. This skill finds those and the other dependency bot mistakes below, and tells you how to fix each one.

Your agent runs a scanner on .github/dependabot.yml, Renovate config files (renovate.json, renovate.jsonc, renovate.json5, .renovaterc files, also under .github/ and .gitlab/), the renovate key of package.json, and the workflows in .github/workflows/ that approve or merge Dependabot or Renovate pull requests (other workflows are skipped). It reads JSON with comments and JSON5 the way Renovate does, treats ${{secrets.NAME}} and {{ secrets.NAME }} as secrets kept outside the file, knows Dependabot's 3-day default cooldown, and checks that each Dependabot directory exists in the repository. It never runs the bots or a workflow and never uses the network. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• D01: registry passwords, tokens and keys written in the config (Dependabot registries, Renovate hostRules and auth headers, npmToken, _authToken in npmrc, a password inside a registry URL)
• D02: registries reached over plain HTTP, or Renovate insecureRegistry: true
• D03: config the bot cannot use: invalid Renovate JSON, tab indentation, missing version: 2, updates, package-ecosystem, directory or schedule.interval, wrong ecosystem or interval names, undefined registries or groups, dependabot.yml outside .github/
• D04: workflows on pull_request_target or workflow_run that approve or merge bot pull requests based on github.actor or the event sender

REVIEW (check before release)

• D11: automerge with no release-age wait (Renovate minimumReleaseAge unset, or Dependabot cooldown 0 days with an auto-merge workflow)
• D12: every update type merged on its own, major versions included
• D13: major updates ignored for every dependency
• D14: updates switched off (open-pull-requests-limit: 0, ignore "*" for everything, Renovate enabled: false)
• D15: Renovate vulnerability alerts turned off
• D16: remote Renovate presets not pinned to a tag
• D17: Dependabot insecure-external-code-execution: allow
• D18: merges that skip checks (gh pr merge without --auto or with --admin, direct merge API calls, Renovate ignoreTests with automerge)
• D19: Dependabot directories that do not exist or hold no manifest for their ecosystem

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official source for each rule
• A risky and a safe example (a web app with Dependabot and an auto-merge workflow, and a service with Renovate), and the real report the scanner produces on the risky one

Limits

It reads each file as written. Settings made outside the repository (bot settings in the GitHub or Mend UI, Dependabot secrets, branch protection, GitHub's auto-merge setting) are not seen, and remote presets are named but not fetched, so their content is not checked. Workflows are read only for the bot merge patterns above; general workflow security such as script injection or token permissions is not covered. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 20 files: SKILL.md, the scanner in scripts/ (6 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (11 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.