Instruction packages need review too
Dependabot, GitHub’s update helper, can now propose newer versions of supported AI instruction packages managed with Agent Package Manager (APM). APM organizes reusable skills, prompts, and instructions for AI helpers. A pull request is a proposed change for review. [1]
On github.com this covers all plans; GitHub Enterprise Server support is planned for version 3.24. These are version updates, not security updates. [1]
Select apm in .github/dependabot.yml, the updater’s settings file, and point it to the folder holding apm.yml. Support covers only documented Git entries, references to material in the project-history system. [1][2]
Dependabot regenerates apm.lock.yaml only if it exists. That lockfile records chosen versions; following a Git branch, a moving development line, requires it. Check the docs for excluded entry formats. [2]
Our take
New instructions can change your helper’s behavior. Suppose a code-review skill gains a new rule about which problems to flag. Read the changed instructions, try a harmless sample with a known issue, and inspect what the helper reports before accepting the update.
Keep the reviewer and approval step you would use for application code. A version bump can make a useful improvement, but the update proposal alone does not tell you whether the new instructions suit your project. Write down why you accepted it so the next maintainer can follow the decision.