plugins/github-copilot-modernization/skills/assessment/SKILL.md
Run application assessment for a single repository
npx skillsauth add microsoft/github-copilot-modernization assessmentInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
This skill performs application assessment for a single repository. It supports Java, .NET, and JavaScript/TypeScript projects.
workspace-path (optional): Path to the project to assess. Defaults to the current directory (repository root) when not specified. All assessment outputs are written relative to this path (e.g. {workspace-path}/.github/modernize/assessment/reports/report-{reportId}/report.json). For a repository with multiple sub-projects, pass the sub-project directory path so that each sub-project's outputs are isolated.Use this skill when you need to:
This skill performs a simplified assessment workflow:
Check Project Type and Prerequisites:
Run Assessment:
dotnet tool update dotnet-appcat{workspace-path}projectPaths="project1.csproj;project2.csproj"appcat analyze $projectPaths --source Solution --target Any --serializer APPMODJSON --code --privacyMode Restricted --non-interactive --report {workspace-path}\.github\modernize\appcat\result\report.jsonnpm install -g [email protected] --prefix {tool-install-dir}ncu --format group --packageFile {workspace-path}/package.jsonreportId as a UTC timestamp formatted as yyyyMMddHHmmss (e.g. 2024-06-15T14:30:52Z becomes 20240615143052)mkdir -p {workspace-path}/.github/modernize/assessment/reports/report-{reportId}{workspace-path}/.github/modernize/assessment/reports/report-{reportId}/js-assessment-report.mdSave Report to Versioned Directory (All languages):
{workspace-path}/.github/modernize/assessment/reports/report-{reportId}/report.json — no manual saving neededreport.json under {workspace-path}/.github/modernize/appcat/result/metadata.analysisStartTimeyyyyMMddHHmmss to produce the reportId (e.g. 2024-06-15T14:30:52Z becomes 20240615143052)mkdir -p {workspace-path}/.github/modernize/assessment/reports/report-{reportId}{workspace-path}/.github/modernize/assessment/reports/report-{reportId}/report.jsonreport.json at {workspace-path}/.github/modernize/appcat/result/report.jsonmetadata.analysisStartTimeyyyyMMddHHmmss to produce the reportId (e.g. 2024-06-15T14:30:52Z becomes 20240615143052)mkdir -p {workspace-path}/.github/modernize/assessment/reports/report-{reportId}{workspace-path}/.github/modernize/assessment/reports/report-{reportId}/report.jsonFor Java projects:
For .NET projects:
dotnet-appcat tool if not already presentFor JavaScript/TypeScript projects:
npm-check-updates if not already presentSimply express the intent to assess the application. Example prompts:
The assessment process automatically:
{workspace-path}{workspace-path}/.github/modernize/assessment/reports/report-{reportId}/report.json{workspace-path}/.github/modernize/appcat/result/, then moved to versioned directory{workspace-path}/.github/modernize/appcat/result/report.json{workspace-path}/.github/modernize/assessment/reports/report-{reportId}/js-assessment-report.mdFor Java projects:
{workspace-path}/.github/modernize/assessment/reports/report-{reportId}/report.json — no manual report moving is neededreport.json under {workspace-path}/.github/modernize/appcat/result/metadata.analysisStartTime, format as yyyyMMddHHmmss to get reportId{workspace-path}/.github/modernize/assessment/reports/report-{reportId}/report.jsonFor .NET projects:
{workspace-path}/.github/modernize/appcat/result/report.jsonmetadata.analysisStartTime, format as yyyyMMddHHmmss to get reportId{workspace-path}/.github/modernize/assessment/reports/report-{reportId}/report.jsonFor JavaScript/TypeScript projects:
reportId as a UTC timestamp formatted as yyyyMMddHHmmss (e.g. 2024-06-15T14:30:52Z becomes 20240615143052)mkdir -p {workspace-path}/.github/modernize/assessment/reports/report-{reportId}{workspace-path}/.github/modernize/assessment/reports/report-{reportId}/js-assessment-report.mdReport location depends on project type:
For Java projects (via MCP server):
{workspace-path}/.github/modernize/assessment/reports/report-{reportId}/report.json{workspace-path}/.github/modernize/appcat/result/, then moved to versioned directory: {workspace-path}/.github/modernize/assessment/reports/report-{reportId}/report.jsonFor .NET projects (direct execution):
{workspace-path}/.github/modernize/appcat/result/report.json{workspace-path}/.github/modernize/assessment/reports/report-{reportId}/report.jsonFor JavaScript/TypeScript projects (direct execution):
{workspace-path}/.github/modernize/assessment/reports/report-{reportId}/js-assessment-report.mdAssessment is complete when:
{workspace-path}/.github/modernize/assessment/reports/report-{reportId}/report.json{workspace-path}/.github/modernize/assessment/reports/report-{reportId}/js-assessment-report.mdPrerequisites Not Met:
dotnet --version commandnpm --version commandAssessment Failures:
{workspace-path}/package.jsonReport Generation Issues:
{workspace-path}/.github/modernize/assessment/reports/report-*/report.json after MCP execution{workspace-path}/.github/modernize/appcat/result/ after MCP execution{workspace-path}/.github/modernize/appcat/result/report.json, or metadata.analysisStartTime missing from report{workspace-path}/.github/modernize/assessment/reports/report-{reportId}/js-assessment-report.mdFor any failure, provide clear error messages and troubleshooting steps.
development
Scan dependency manifests against known CVEs and remediate by upgrading vulnerable dependencies to patched versions, then rebuild and re-scan to confirm. Self-contained scan→fix→verify loop for any project with a dependency manifest. Use when: a cve-remediation task is dispatched; dependency set changed (version bump, new framework); assessment flagged vulnerable or EOL dependencies; or user asked to "fix CVEs", "patch vulnerabilities", or "dependency security". Triggers: "cve", "remediate cve", "fix cves", "patch vulnerable dependencies", "vulnerability scanning", "dependency security", "vulnerable dependencies", "security advisories", "npm audit", "pnpm audit", "maven audit", "gradle audit", "dependency scan", "vulnerability remediation". NOT for: security audit of auth/input/secrets/OWASP code paths (use security-review).
development
Generate dependency map diagram from project build files
documentation
Generate data architecture and persistence layer documentation with data model diagram
documentation
Generate core business workflow documentation with sequence diagram