Dependabot now opens pull requests for agent skills and prompts

GitHub says you can now keep "AI agent skills, prompts, and instructions" up to date with Dependabot version updates for Agent Package Manager (APM). Dependabot opens pull requests to update supported git dependencies declared in apm.yml and regenerates apm.lock.yaml when that file is present. To enable it, add an apm entry to .github/dependabot.yml, point it at the directory holding apm.yml, and pick a schedule.

The support covers version updates, not security updates. GitHub says it is generally available on github.com for all plans and will arrive in GitHub Enterprise Server 3.24.

Why it matters: If your harness pulls skills or instructions from other repositories, an update now arrives as a reviewable pull request instead of a silent change. That puts a changed skill through the same review and tests as a code change. The changelog does not say what those pull requests contain beyond version bumps, so check what one looks like before relying on it.