Every Monday: open Dependabot alerts joined with npm publish dates and your imports, so the vulnerable packages with no fix coming are at the top.
Reads
You get
The card on the right is a sample. Yours shows your own numbers and updates in place every run.
What lands on your board
Which should I open GitHub issues for?
Of 11 open Dependabot alerts, 3 are in packages with no release in 18 months or more, and only one of those has a patched version. 1 of them is in the checkout service, imported directly.
Dependabot lists 11 open alerts and sorts them by severity. What it does not tell you is that three of them sit in packages whose last release was two years ago, so no patched version is coming and waiting for the bot's pull request is a plan that never ends. And it cannot say whether the package is imported by your checkout service or by a script someone ran once.
This skill is for the developer who owns dependency hygiene in a JavaScript repo. Every Monday the agent joins each open npm alert with the registry's publish history and deprecation notice, then greps the code for where the package is imported. The card puts the abandoned, unpatched, production-imported ones first and asks which to turn into GitHub issues.
Call GET /repos/{owner}/{repo}/dependabot/alerts?state=open&ecosystem=npm&per_page=100 (or gh api with the same path). Keep number, html_url, dependency.package.name, dependency.manifest_path, dependency.scope (runtime or development), dependency.relationship, security_advisory.ghsa_id, security_advisory.severity, security_vulnerability.vulnerable_version_range and security_vulnerability.first_patched_version.
For each distinct package, GET https://registry.npmjs.org/<name> (scoped names URL-encode the slash). Last publish is the newest timestamp in time, ignoring the created and modified keys, since modified also changes on metadata edits. Note versions[<dist-tags.latest>].deprecated, and call the package abandoned when its last publish is 18 or more months old or its latest version is deprecated.
The key is the package name exactly as npm writes it, scope included. Run git grep -nE "(from |require\(|import\()['\"]<name>(/[^'\"]*)?['\"]" and map each hit to a service by its top folder (services/checkout/ is checkout). It is direct when the name is in the package.json next to manifest_path (or relationship is direct); otherwise npm ls <name> --all --json or pnpm why <name> names the parent that pulls it in. A direct dependency with no import is unused and can go; a transitive one with no import is fixed by upgrading or replacing its parent.
Order: abandoned with no first_patched_version and runtime scope first, then abandoned with a patch available (bump it now), then maintained packages (Dependabot will handle them). Development-scope alerts go last. Within each group, critical before high before moderate.
Read the previous card with GET https://briefkin.dev/v1/cards/insight-github-dependabot-abandoned-dependencies (same item_key every run), or a small JSON file of alert numbers kept between runs, and tag alerts that were not there last Monday.
Post the ranked list as an ask. For each package picked, run gh issue create with the alert link, the advisory, the last publish date, every import line found and a suggested replacement or the parent to upgrade. Change no code.
With BRIEFKIN_TOKEN set, the agent sends the result as one card that updates in place every run. Without it, you get the report in the chat.
Pick your agent, where the data comes from and how to schedule it; the commands below follow.
One command. It puts the SKILL.md in ~/.claude/skills and in ~/.agents/skills, which Codex, Cursor, Gemini CLI, Copilot CLI and OpenCode read too.
shellcurl -fsSL https://briefkin.dev/skills/github-dependabot-abandoned-dependencies/install | shAsk Claude Code:
promptRun the github-dependabot-abandoned-dependencies skillOr paste the prompt instead of installing:
promptList the open Dependabot alerts for npm in <owner/repo> (GET /repos/{owner}/{repo}/dependabot/alerts?state=open&ecosystem=npm). For each package, read https://registry.npmjs.org/<name>: the newest publish date in time (ignore created and modified) and whether the latest version is deprecated. Call it abandoned if it has not published in 18 months or is deprecated. Then grep the repo for where each abandoned package is imported, say which service folder that is, and whether it is a direct dependency or pulled in by another package (npm ls or pnpm why). Rank abandoned with no patched version and runtime scope first. Show package, severity, last publish, patched version and where it is used, then ask me which to open GitHub issues for. Do not change any code.Mondays at 9:30, from cron on any machine where Claude Code is signed in:
crontab30 9 * * 1 claude -p "Run the github-dependabot-abandoned-dependencies skill"Add it with crontab -e. A laptop asleep at that time runs it when it wakes if you use launchd or Task Scheduler instead; GitHub Actions works for the API route.
Connect Briefkin once with curl -fsSL https://briefkin.dev/install | sh and every run lands on your board as a question for you. How setup works
SKILL.md---
name: github-dependabot-abandoned-dependencies
description: "Every Monday: open Dependabot alerts joined with npm publish dates and your imports, so the vulnerable packages with no fix coming are at the top. Use when the user asks for this, or when it runs on a schedule."
---
# Vulnerable and abandoned dependencies: Dependabot and npm
Every Monday: open Dependabot alerts joined with npm publish dates and your imports, so the vulnerable packages with no fix coming are at the top.
Dependabot lists 11 open alerts and sorts them by severity. What it does not tell you is that three of them sit in packages whose last release was two years ago, so no patched version is coming and waiting for the bot's pull request is a plan that never ends. And it cannot say whether the package is imported by your checkout service or by a script someone ran once.
This skill is for the developer who owns dependency hygiene in a JavaScript repo. Every Monday the agent joins each open npm alert with the registry's publish history and deprecation notice, then greps the code for where the package is imported. The card puts the abandoned, unpatched, production-imported ones first and asks which to turn into GitHub issues.
## Two ways to get the data
Use the API or MCP route when you have an MCP server, a CLI or an API token for the app. Otherwise, if you can drive a browser the user is signed in to (Claude in Chrome, a Playwright or Chrome DevTools MCP server), use the browser route. Say which one you used.
## Route A: API or MCP server
### What you need
- A fine-grained GitHub token or the GitHub MCP server with Dependabot alerts: Read and Contents: Read on the repository, plus Issues: Write if it should open issues.
- A checkout of the repository with its lockfile, so `git grep` and `npm ls` (or `pnpm why`) can see imports and the dependency tree. The npm registry needs no token for public packages.
- A folder-to-service map when the repo holds several services (`services/checkout` = checkout), so an alert can be named by the service that ships it.
If something is missing, say what and stop; do not invent numbers.
### Steps
1. **Pull the open npm alerts** (GitHub): Call `GET /repos/{owner}/{repo}/dependabot/alerts?state=open&ecosystem=npm&per_page=100` (or `gh api` with the same path). Keep `number`, `html_url`, `dependency.package.name`, `dependency.manifest_path`, `dependency.scope` (`runtime` or `development`), `dependency.relationship`, `security_advisory.ghsa_id`, `security_advisory.severity`, `security_vulnerability.vulnerable_version_range` and `security_vulnerability.first_patched_version`.
2. **Read each package's publish history** (npm): For each distinct package, `GET https://registry.npmjs.org/<name>` (scoped names URL-encode the slash). Last publish is the newest timestamp in `time`, ignoring the `created` and `modified` keys, since `modified` also changes on metadata edits. Note `versions[<dist-tags.latest>].deprecated`, and call the package abandoned when its last publish is 18 or more months old or its latest version is deprecated.
3. **Join alerts to the code that imports them**: The key is the package name exactly as npm writes it, scope included. Run `git grep -nE "(from |require\(|import\()['\"]<name>(/[^'\"]*)?['\"]"` and map each hit to a service by its top folder (`services/checkout/` is checkout). It is direct when the name is in the `package.json` next to `manifest_path` (or `relationship` is `direct`); otherwise `npm ls <name> --all --json` or `pnpm why <name>` names the parent that pulls it in. A direct dependency with no import is unused and can go; a transitive one with no import is fixed by upgrading or replacing its parent.
4. **Rank by what you can actually do**: Order: abandoned with no `first_patched_version` and runtime scope first, then abandoned with a patch available (bump it now), then maintained packages (Dependabot will handle them). Development-scope alerts go last. Within each group, critical before high before moderate.
5. **Mark what is new since last week**: Read the previous card with `GET https://briefkin.dev/v1/cards/insight-github-dependabot-abandoned-dependencies` (same `item_key` every run), or a small JSON file of alert numbers kept between runs, and tag alerts that were not there last Monday.
6. **Ask, then open issues** (GitHub): Post the ranked list as an ask. For each package picked, run `gh issue create` with the alert link, the advisory, the last publish date, every import line found and a suggested replacement or the parent to upgrade. Change no code.
## Route B: the browser
### What you need
- Signed in to GitHub with access to the repository's security alerts (admin or a role with Dependabot alert access) and permission to open issues.
If something is missing, say what and stop; do not invent numbers.
### Steps
Start at https://github.com/. The user is signed in already; never type passwords or codes, and ask if a sign-in page appears.
1. **Open the Dependabot alerts**: Open the repository, then **Security** > **Dependabot**. Filter with `is:open ecosystem:npm` and read each row: package, severity and manifest. Open each alert to note the patched version, or that there is none.
2. **Check each package on npm**: Open `https://www.npmjs.com/package/<name>` for each package. Read **Last publish** in the sidebar, the **Versions** tab for the newest release date, and any deprecation banner at the top. Abandoned means no release in 18 months or more, or deprecated.
3. **Find where it is imported**: In GitHub code search, search `repo:<owner>/<repo> "from '<name>'"` and `repo:<owner>/<repo> "require('<name>')"`. Note the folder of each hit, and open the `package.json` next to the alert's manifest: listed there means direct, absent means a transitive dependency of another package.
4. **Rank and ask**: Put abandoned, unpatched, runtime packages first, then those a version bump fixes, then dev-only ones. Show the table and ask which to turn into issues; open issues only for the ones picked, with the alert link and the import lines.
Note: GitHub code search misses dynamic imports and paths built at runtime, and it cannot show the dependency tree, so a transitive package's parent is not visible from the browser; the API route runs `npm ls` for that. Past 30 or so alerts the browser route gets slow.
## The report
- **Open npm alerts** and how many sit in abandoned packages.
- **Abandoned and unpatched**: package, severity, last publish, deprecation note, and where it is imported.
- **Patch available**: alerts you can close with a version bump today.
- **Transitive only**: the parent package to upgrade or replace.
- The ask: which ones to open issues for, with the one to fix first named, for example "replace request in services/checkout".
## Post it to Briefkin
When `BRIEFKIN_TOKEN` is set, or `~/.config/briefkin/env` exists (the installer from https://briefkin.dev/docs writes it), also send the result to the user's Briefkin board as one card. Keep the `item_key` the same on every run so the card updates in place, use a new `event_id` per run, and put today's real numbers in place of the example ones. If the request fails, say so once and carry on.
```bash
[ -n "${BRIEFKIN_TOKEN:-}" ] || . ~/.config/briefkin/env
curl -sS -X POST "${BRIEFKIN_URL:-https://briefkin.dev}/v1/events" \
-H "authorization: Bearer $BRIEFKIN_TOKEN" \
-H "content-type: application/json" \
-d @- <<'JSON'
{
"v": 1,
"event_id": "github-dependabot-abandoned-dependencies/<date of this run, e.g. 2026-10-16>",
"item_key": "github-dependabot-abandoned-dependencies",
"project": "acme-web",
"source": "Vulnerable and abandoned dependencies: Dependabot and npm skill",
"kind": "action",
"title": "3 alerts are in packages not published for 18+ months",
"summary": "Of **11 open Dependabot alerts**, **3** are in packages with no release in 18 months or more, and only one of those has a patched version. **1 of them is in the checkout service**, imported directly.",
"action": {
"request": "Which should I open GitHub issues for?",
"options": [
"All 3",
"Only the checkout one",
"The 2 with no fix",
"None this week"
]
},
"widget": [
{
"type": "Table",
"props": {
"columns": [
"Package",
"Severity",
"Last publish",
"Patched",
"Used in"
],
"align": [
"left",
"left",
"left",
"left",
"left"
],
"rows": [
[
"request 2.88.2",
"moderate",
"Feb 2020, deprecated",
"none",
"services/checkout, direct"
],
[
"acme-yaml 1.3.0",
"high",
"Mar 2024",
"none",
"services/api, via acme-config"
],
[
"acme-jsonpath 0.9.1",
"high",
"Jan 2025",
"0.9.2",
"scripts/ only, dev"
]
]
}
},
{
"type": "Badges",
"props": {
"items": [
{
"label": "8 alerts in maintained packages",
"tone": "neutral"
},
{
"label": "1 new since last week",
"tone": "info"
},
{
"label": "1 fix is a version bump",
"tone": "ok"
}
]
}
},
{
"type": "Callout",
"props": {
"text": "request has no fix coming: services/checkout/src/payments/paypal.ts imports it for 2 calls that native fetch covers.",
"tone": "bad"
}
}
]
}
JSON
```
Widgets come from the Briefkin catalog (https://briefkin.dev/v1/catalog). Without a token, just give the user the report.
## Run it on a schedule
Suggested: Mondays at 9:30 (`30 9 * * 1`). From cron, with the agent signed in on that machine:
```bash
30 9 * * 1 claude -p "Run the github-dependabot-abandoned-dependencies skill"
# Codex: codex exec, Gemini CLI: gemini -p, Copilot CLI: copilot -p, OpenCode: opencode run
```
Or use the agent's own scheduler (Claude Code routines, Codex automations, Claude or ChatGPT scheduled tasks): https://briefkin.dev/skills/github-dependabot-abandoned-dependencies#schedule
Source: https://briefkin.dev/skills/github-dependabot-abandoned-dependencies
A fine-grained GitHub token or the GitHub MCP server with Dependabot alerts: Read and Contents: Read on the repository, plus Issues: Write if it should open issues.
A checkout of the repository with its lockfile, so git grep and npm ls (or pnpm why) can see imports and the dependency tree. The npm registry needs no token for public packages.
A folder-to-service map when the repo holds several services (services/checkout = checkout), so an alert can be named by the service that ships it.
https://api.githubcopilot.com/mcp/. Sign in with OAuth or a personal access token; add /readonly to the URL, or use a toolset URL such as https://api.githubcopilot.com/mcp/x/pull_requests/readonly, to expose only read tools. It also runs locally (source).gh CLI. Run gh auth login once, or set GH_TOKEN for scheduled runs. gh pr list --search "review-requested:@me" --json number,title,url,createdAt and gh api repos/{owner}/{repo}/dependabot/alerts cover most reports.GITHUB_TOKEN, limit it to the repositories in the report, and grant Read on Metadata, Contents, Pull requests and Issues, plus Dependabot alerts if you report on them.With every permission on a fine-grained token set to Read, the agent can't push, merge, comment or close anything.
npm outdated --json, npm audit --json and npm view <package> time --json in the project, and curl the registry and downloads API; public packages need no token.NPM_TOKEN, and reference it in .npmrc as //registry.npmjs.org/:_authToken=${NPM_TOKEN}.A read-only granular token can install and inspect packages but never publish; don't reuse a publish token for reports.
A package can get commits for years without a release, and only a release reaches your lockfile. The registry's time map says when a version you could install last appeared. The skill ignores time.modified, which changes when metadata is edited, not when code ships.
Each Dependabot alert carries its manifest_path, so the join runs per manifest: the direct-or-transitive check reads the package.json beside that path, and the import grep is limited to that workspace's folder. The same package in two workspaces shows as two rows.
No. The skill runs with your own agent and gives you the report in the chat. With a Briefkin token set, each run also posts it to your board as a asks you, so you can glance at it instead of asking again.
Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI, OpenCode, Windsurf and Amp all read SKILL.md files. The install command puts it in ~/.claude/skills and ~/.agents/skills, where they look. ChatGPT, the Claude app and Grok take the prompt instead. Pick your agent under "Install and run it" and the commands change to match.
Yes. Switch the data source to "Your browser" and the steps change to the GitHub and npm pages themselves: the agent opens github.com in a browser you are signed in to and reads the numbers off the page. Claude Code, Codex, Cursor, Claude app and ChatGPT can drive a browser out of the box; Gemini CLI, Copilot CLI and OpenCode need a Playwright or Chrome DevTools MCP server first. It is slower than the API and needs you signed in, so it suits a report you run by hand or from a scheduler on your own computer.
Skills are free to use with any agent. Briefkin is where their results land: one board for every report, number and question your agents send, with a ping when something needs you.
Free during the open beta. No card.