Review a Dependabot PR with a checked-in merge skill

Write SKILL.md for reviewing and merging Dependabot (or Renovate) dependency PRs in this repository. The agent must not merge on green lockfile alone.

Repository context:
[package manager, lockfile paths, test/lint/typecheck scripts from package.json]
[CI job name that runs on PRs, if any]

Typical bump types we see:
[patch/minor routine vs major framework bumps — name the packages that need extra care]

SKILL.md sections in order:
1. Purpose — safe dependency updates with evidence, not rubber-stamp.
2. When to use / when not to use (include: stop and escalate if the PR touches more than [N] packages or removes a dependency without a ticket).
3. Required inputs: PR number or branch, link to release notes or compare URL for the main bumped package, and whether production deploy is allowed today.
4. Steps:
   - List every version change from the lockfile or manifest diff; group by direct vs transitive.
   - For each direct major bump, read upstream release notes and paste a three-bullet summary: breaking changes, migration steps, deprecations — write [read release notes] if the agent cannot fetch them.
   - Checkout the PR branch locally or use gh pr checkout; run in order: [paste lint], [paste typecheck], [paste test] — use [confirm command] for unknowns.
   - Scan the diff for postinstall scripts, native addons, or license file changes; note any in the PR comment.
   - If all checks pass and no major without migration notes, propose merge with squash message format: chore(deps): bump <package> to <version>.
   - If checks fail, fix only if the failure is clearly caused by the bump; otherwise comment with logs and request human review.
5. PR comment template the agent must fill: Packages changed, Risk (low/medium/high), Commands run (with exit codes), Release-notes summary, Merge recommendation (yes/no/needs human).
6. Two example prompts: routine patch bump vs major React/Next bump.
7. Pitfalls: merging with skipped tests, ignoring peer dependency warnings, approving transitive-only bumps that actually change runtime behavior, editing lockfile by hand instead of re-running the bot.
8. Done means: checklist — "all verification commands exit 0 or failures explained", "PR comment posted", "no secrets in comment", "major bumps have migration bullets."

Rules:
- Do not merge without naming the commands actually run.
- Do not invent CVE fixes; link advisories only if present in the PR body.
- Output only SKILL.md markdown.