Dependabot now updates AI agent skills, but pin rules are unconfirmed

On 3 November, GitHub announced Dependabot Agent Package Manager (APM) support. The new version-update integration covers Microsoft's open source dependency manager for AI agent configuration. Dependabot opens pull requests to update the supported git dependencies declared in apm.yml and regenerates apm.lock.yaml when that lockfile is present. Support is generally available on github.com for all plans, and GitHub Enterprise Server 3.24 will follow.

What changes for teams

APM lets a repository declare the skills, prompts, instructions and tools its agents need in one apm.yml manifest, so each developer who clones it gets the same agent setup, according to Microsoft's APM documentation. Until now, keeping those dependencies current was manual work. Setup follows the usual Dependabot pattern: add an apm entry to .github/dependabot.yml, point it at the directory holding apm.yml and choose a schedule.

The changelog does not say which entries Dependabot will update. The public pull request that proposed the ecosystem, number 16382, opened on 24 September by community contributor Diogo Costa, describes a narrower scope. It bumps only entries pinned to a semver tag. Branch pinned, SHA pinned and unpinned entries are ignored, and so are mcp entries, local paths and object form entries. In the community request behind it, GitHub's Carlin Cherry wrote that the team was "picking this up next quarter."

We could not confirm that the released feature matches that pull request. GitHub's supported ecosystems page had no APM section when we checked. Until GitHub documents the rules, pin skills to semver tags if you want Dependabot to see them, and do not read a quiet repository as proof that everything is current.

What it does not cover

GitHub says the support covers version updates, not security updates. Dependabot will propose a newer version of a skill, but it will not alert you that a pinned one is vulnerable or malicious. The changelog also limits updates to supported git dependencies, and the lockfile is regenerated only if it already exists.

The delay GitHub added in July is a related control. Dependabot now waits at least three days before opening a pull request for a new version, so researchers can catch malicious releases first. We found no GitHub statement on whether that delay applies to APM entries, so set a cooldown explicitly and test it.

This is our reading, not GitHub's: a skill or prompt tells an agent what to do, so a version bump can change agent behaviour in ways a passing test suite will not show. Enable the ecosystem on one repository first, confirm that an update pull request appears for each pin style you use, and read the diff as you would read code. Enterprise Server users must wait for 3.24. Dependabot alerts are changing too: from 8 December, GitHub will pause alerts on repositories idle for a year. For the kinds of skills teams now share, see our guide to Claude plugins and skills for marketers. More tooling changes are tracked on the News Desk.