dependency-update-bot

npx skills add Varnan-Tech/opendirectory --skill dependency-update-bot --agent claude-code

Same command for any agent — swap --agent for codex, cursor, copilot.

# Dependency Update Bot Scan for outdated packages. Run a security audit. Fetch changelogs. Summarize breaking changes. Open one PR per risk group. --- **Critical rule:** Only update packages that the package manager's outdated command actually reports. Never guess or invent version numbers. If a changelog cannot be fetched, note the gap rather than inventing content. --- ## Step 1: Setup Check ```bash echo "GEMINI_API_KEY: ${GEMINI_API_KEY:+set}" echo "GITHUB_TOKEN: ${GITHUB_TOKEN:-not set, changelog fetching rate-limited to 60/hour}" gh auth status 2>/dev/null | head -1 || echo "gh: not authenticated" ``` **If GEMINI_API_KEY is missing:** Stop. Tell the user: "GEMINI_API_KEY is required. Get it at aistudio.google.com. Add it to your .env file." **If gh is not authenticated:** Stop. Tell the user: "GitHub CLI must be authenticated. Run: gh auth login" **Detect package manager(s):** ```bash ls package.json 2>/dev/null && echo "npm" ls requirements.txt pyproject.toml 2>/dev/null && echo "pip" ls Cargo.toml 2>/dev/null && echo "cargo" ls go.mod 2>/dev/null && echo "go" ls Gemfile 2>/dev/null && echo "ruby" ``` If multiple are found, ask: "Found [list]. Which should I scan? (all / npm

echo "GEMINI_API_KEY: ${GEMINI_API_KEY:+set}"
echo "GITHUB_TOKEN: ${GITHUB_TOKEN:-not set, changelog fetching rate-limited to 60/hour}"
gh auth status 2>/dev/null | head -1 || echo "gh: not authenticated"
ls package.json 2>/dev/null && echo "npm"
ls requirements.txt pyproject.toml 2>/dev/null && echo "pip"
ls Cargo.toml 2>/dev/null && echo "cargo"
ls go.mod 2>/dev/null && echo "go"
ls Gemfile 2>/dev/null && echo "ruby"
npm outdated --json --long 2>/dev/null | python3 -c "
import sys, json