sagargupta16/renovate-triage
plugins/renovate-triage/skills/renovate-triage/SKILL.md
Use when triaging open Renovate PRs across your own repos into merge / close / defer. Activates on "renovate triage", "review dep PRs", "monthly deps", or on the 1st of a month if deps are grouped monthly.
$ install --global
skillsauthnpx skillsauth add sagargupta16/claude-skills renovate-triageInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 23, 2026, 5:15 AM10.5s1 file scanned
SKILL.md
- name:
- renovate-triage
- description:
- Use when triaging open Renovate PRs across your own repos into merge / close / defer. Activates on "renovate triage", "review dep PRs", "monthly deps", or on the 1st of a month if deps are grouped monthly.
- disable-model-invocation:
- true
- allowed-tools:
- Bash(gh search prs:*) Bash(gh api:*) Bash(gh pr:*)
renovate-triage
Live data
- Open Renovate PRs authored by
app/renovateon your repos: !gh search prs --author app/renovate --state open --json repository,title,number,url --limit 100 2>/dev/null || echo "gh unavailable or not authenticated"
When to activate
- User says "renovate triage", "review dep PRs", "monthly deps", "batch deps".
- It's the 1st of the month and deps are grouped monthly.
Skip if: the user is asking about a single specific PR (use a PR-review skill instead), or if Renovate isn't configured on their repos.
Steps
- Use the live PR list above. Do not re-fetch.
- Group by repo. One repo's PRs often share the same grouping rule.
- For each PR, fetch merge state and CI:
gh api repos/{owner}/{repo}/pulls/{num} --jq '{mergeable, mergeStateStatus, title, labels}'gh pr checks <url>
- Classify each PR:
- Merge -- CI green, patch or minor bump, library is stable and well-adopted, no flags in the repo's Renovate config.
- Close -- superseded by a newer PR, wrong repo, duplicate, or abandoned.
- Defer -- major version bump, known breaking change, CI red that needs investigation, or a library that the repo pins deliberately.
- Output a table grouped by repo with recommended action per PR.
- Do not merge automatically. Present the plan; the user approves.
- After approval, merge in order, one repo at a time, verifying CI between merges (not in parallel).
Rules
- Never merge a Renovate PR with unresolved security findings on the PR or the repo.
@types/*-only bumps can silently break builds -- always check CI is green before merging, not just "mergeable".- Major bumps always defer. React 18 -> 19, Next 14 -> 15, Node 20 -> 22, etc. These are planned work, not routine hygiene.
- Close old superseded PRs before merging the latest one in a grouped series -- otherwise Renovate may reopen them.
Output
| Repo | PR | Bump | CI | Action | Notes |
|---|---|---|---|---|---|
Group by repo. After the table, list the proposed merge order across all repos.
Related Skills
sagargupta16/starter-session-audit
testing
VerifiedTrustedCommunity
Use when the user asks to audit a session for uncaptured learnings. Activates on "audit this session", "session audit", "what did we miss", "end of session check", or "/starter-session-audit". Scans the conversation for corrections, preferences, decisions, and new context, then proposes where to save each.
4SKILL.mdUpdated May 23, 2026
sagargupta16/repo-polish
testing
VerifiedTrustedCommunity
Use when setting up new repositories, auditing existing ones, or preparing repos for public visibility. Generates .gitignore, .env.example, README, and LICENSE files. Detects committed secrets and flags security issues.
4SKILL.mdUpdated May 23, 2026
sagargupta16/refactoring
development
VerifiedTrustedCommunity
Use when restructuring code without changing behavior -- extracting functions, renaming, moving files, reducing duplication, migrating between patterns (JS to TS, CJS to ESM), or addressing code smells. Covers safe refactoring workflows for any language.
4SKILL.mdUpdated May 23, 2026
sagargupta16/oss-contrib
development
VerifiedTrustedCommunity
Use when contributing to open source projects from forked repositories. Handles upstream sync, CONTRIBUTING.md compliance, code style matching, PR preparation, and project-specific patterns. Activates for fork management, PR template filling, and upstream workflow compliance.
4SKILL.mdUpdated May 23, 2026