CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · CONTRIBUTING.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptCONTRIBUTING.md· markdown

272. **Idempotent.** Re-running a bootstrap produces the same state. Never overwrite user cont

… (56 chars elided on L27)

283. **Profiles are data, never code.** No `eval`, no embedded scripts, no remote includes.

294. **`gh` integration is always best-effort.** Skip with a logged reason; never fatal, never

… (18 chars elided on L29)

305. **MCP boundary.** Shell scripts never invoke MCP tools — only the skill layer does.

316. **No internal references in code.** Names must be self-descriptive. Traceability belongs

… (15 chars elided on L31)

Occurrences

1 occurrence · at L29

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha256183eb789192b5159…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/gen-dependency-updater/SKILL.md · 1 file

skills/gen-dependency-updater/SKILL.md6.7 KB · Markdown

name: gen-dependency-updater

description: >

Generate a Dependabot or Renovate config (`.github/dependabot.yml`

or `renovate.json`) for the active stack with sensible defaults

(weekly schedule, minor+patch grouping, open-PR cap at 5). Preview-

before-mutate: prints the rendered config and exits without writing

unless `--apply` is passed. Idempotent: same content is a no-op,

different content shows a diff and refuses to overwrite without

`--force-overwrite`.

TRIGGER when the user says "add dependabot", "enable dependabot",

"add renovate", "set up renovate", "configure dependency updates",

"automate dependency updates", "scaffold dependabot.yml", "create

renovate.json", "add automated dependency PRs", "wire dependency

bot", "turn on dependency updates", "/nyann:gen-dependency-updater".

Do NOT trigger on "update my dependencies" / "run npm update" —

that's a one-off package-manager invocation, not config scaffolding.

Do NOT trigger on "fix this dependabot PR" — that's a workflow

inside a specific PR, not config generation.

arguments:

- name: updater

description: Which generator to emit — `dependabot` (per-ecosystem YAML) or `renovate` (single JSON using `config:recommended`).

- name: ecosystem

description: Repeatable. Dependabot's `package-ecosystem` value (npm / pip / gomod / cargo / bundler / composer / maven / gradle / pub / nuget / mix / swift / docker / github-actions). `npm` covers npm/pnpm/yarn/bun. For monorepos pair with `--directory` per workspace.

- name: directory

description: Repo-relative directory of the manifest, must start with `/`. Default `/` (repo root). When `--ecosystem` repeats, place `--directory` BEFORE the corresponding `--ecosystem` to associate them.

optional: true

- name: target

description: Path to the repo. Required only when `--apply` is set; preview mode doesn't need it.

optional: true

- name: apply

description: Write the config to the destination path. Without it, the rendered config is printed to stdout (preview).

optional: true

- name: force-overwrite

description: Overwrite an existing config whose content differs from the rendered output. Without it, the script prints a diff and exits with code 3.

optional: true

- name: schedule

description: How often the updater polls — `daily`, `weekly` (default), or `monthly`.

optional: true

- name: grouping

description: How to bundle updates — `off` (one PR per update), `minor-patch` (default, groups minor+patch, keeps majors separate), `all` (group everything).

optional: true

- name: open-prs

description: Max open dependency-updater PRs per ecosystem (1-25, default 5).

optional: true

gen-dependency-updater

Wraps bin/gen-dependency-updater.sh. Emits a Dependabot or Renovate config; preview-by-default; idempotent on apply.

When to trigger

User wants automated dependency PRs and doesn't already have either

config wired up.

User wants to migrate Dependabot ↔ Renovate.
User wants to re-generate the config after upgrading nyann (the

template defaults shift with each snapshot_version).

When NOT to trigger

User wants to manually upgrade a specific dep — that's

npm install, pip install -U, cargo update, etc.

User wants help resolving a Dependabot/Renovate PR — read the

PR diff with them; this skill is for config generation only.

User is in a non-GitHub forge — Dependabot is GitHub-specific.

Renovate runs anywhere but its app installation is out of scope for this skill.

Picking updater (when the user hasn't specified)

Default to dependabot when:

The repo is on GitHub (which is nyann's gh-integration assumption).
The user wants minimal moving parts (Dependabot is native to GH,

no app to install).

Default to renovate when:

The user mentions multi-platform forge support.
The user wants advanced grouping / customization (Renovate's

package rules are richer than Dependabot's groups).

The user is already a Renovate user on other repos.

When in doubt, ask:

"Dependabot is GitHub-native and zero-install — recommended for most. Renovate is more configurable but requires installing the Renovate GitHub App. Which do you want?"

Picking ecosystems

Read the StackDescriptor (from bin/detect-stack.sh) and map:

Stack hint	Ecosystem(s)
`primary_language=typescript` / `javascript`	`npm`
`primary_language=python`	`pip`
`primary_language=go`	`gomod`
`primary_language=rust`	`cargo`
`primary_language=ruby`	`bundler`
`primary_language=php`	`composer`
`primary_language=java` (Maven)	`maven`
`primary_language=java` (Gradle) / `kotlin`	`gradle`
`primary_language=dart`	`pub`
`primary_language=csharp` / `dotnet`	`nuget`
`primary_language=elixir`	`mix` (v1.10+)
`primary_language=swift`	`swift`
`Dockerfile` present	`docker` (in addition to language ecosystem)
`.github/workflows/` present	`github-actions` (always recommended)

Always include github-actions even when the user didn't ask — it keeps the SAST workflow pins current.

For monorepos (workspaces resolved by bin/resolve-workspace-configs.sh), emit one --ecosystem per workspace with the workspace path as --directory. Dependabot doesn't auto-walk; one entry per manifest is mandatory.

Preview, then apply

Always preview first. Even if the user said "just do it", show the rendered config and wait for confirmation:

bin/gen-dependency-updater.sh --updater dependabot --ecosystem npm --ecosystem github-actions

Then on confirmation:

bin/gen-dependency-updater.sh --updater dependabot \
  --ecosystem npm --ecosystem github-actions \
  --target . --apply

If the destination file already exists and matches: log "unchanged" and exit. If it differs: print diff, exit 3, prompt the user before re-running with --force-overwrite.

Output

.github/dependabot.yml (Dependabot)
renovate.json (Renovate, at repo root)

Both files include a comment header tagging the nyann version that generated them, so a future operator can tell when to regenerate.

Defaults explained

Schedule = weekly: Daily is noisy for most teams; monthly lets

CVEs sit. Weekly balances responsiveness vs. PR-fatigue.

Grouping = minor-patch: Bundles minor + patch into one PR per

ecosystem (review-friendly). Majors stay separate because they often need breaking-change review regardless of patch size.

open-prs = 5: Enough headroom for routine churn; raise for

high-velocity repos.

Labels = `dependencies`, `automated`: automated lets you opt

these out of expensive CI matrices via label filters.

Override any of these via the corresponding flags.

gen-dependency-updater— agent skill

Is gen-dependency-updater safe to install?

gen-dependency-updater

When to trigger

When NOT to trigger

Picking updater (when the user hasn't specified)

Picking ecosystems

Preview, then apply

Output

Defaults explained

Audit the pieces. Scan the whole. Decide.