Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
- Expanded safety guardrails to prohibit direct pushes to both `main` and `master` branches. - Refined the approval gate to explicitly require displaying planned file/version changes and always request approval for non-trivial edits. - Added a new "Required Permissions & Least-Privilege Policy" section outlining strict access and permission boundaries. - Strengthened prohibitions against modifying files outside the target repository and performing external actions without explicit request. - Clarified steps for handling missing permissions, emphasizing minimum access and transparent permission requests.
What This Skill Does
RepoMedic triages and fixes GitHub dependency hygiene problems, including Dependabot PR failures, pnpm lockfile corruption, transitive CVEs, and CI build breakages caused by dependency resolution. It follows an analyze-first approach with explicit approval gates before touching any files.
It enforces risk labeling and approval gates before any file changes, reducing the chance of breaking a build while trying to fix a security alert.
When to use it
- Fix a Dependabot PR that keeps failing CI checks
- Resolve pnpm-lock.yaml drift blocking a branch merge
- Patch a transitive brace-expansion or lodash CVE without touching direct deps
- Diagnose why a Vercel preview build broke after a dependency update
- Add pnpm.overrides to close a security advisory on a nested package
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Dependabot flagged a critical CVE in brace-expansion and the PR is failing CI
- 1Inspect the Dependabot alert and open PRs to classify the issue
- 2Confirm brace-expansion is a transitive dependency, not a direct one
- 3Propose adding a targeted pnpm.overrides entry, labeled Low risk
- 4Apply the override after user approval and regenerate the lockfile
- 5Run pnpm audit and CI checks to confirm the advisory is closed
PR-ready summary with the override diff, audit confirmation, and a plain-English explanation of what changed and why