plugins/github-copilot-modernization/skills/feature-inventory/SKILL.md
Catalogs existing features from a codebase (API endpoints, user flows, UI screens, observable behaviors) and generates structured feature specs with REQ-XXX IDs, user scenarios, and success criteria. Triggers: "inventory features", "catalog existing functionality", "list what the app does", "extract requirements from code", "generate feature specs from research", "write a spec", "create feature specification", "define requirements". NOT for: implementation planning (use creating-implementation-plan), implementation (use implementing-code).
npx skillsauth add microsoft/github-copilot-modernization feature-inventoryInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
You MUST consider the user input before proceeding (if not empty).
The text in the task description is the feature description. Assume you always have it available. Do not ask the user to repeat it unless they provided an empty command.
Given that feature description, do this:
All outputs are written under your task's Artifact path: (from task metadata).
spec.md ← main artifact (feature specification)
requirements-checklist.md ← quality checklist (if applicable)
Load constitution document (if available) to understand principles and constraints.
Load clarification.md if it exists ({{BASE_PATH}}/clarification.md or path from dependencyArtifacts). Treat every field that has an explicit value (i.e., resolution: user or resolution: default) as already resolved — do NOT re-ask the user about it and do NOT count it against the [NEEDS CLARIFICATION] budget below. Items listed under blocking_gaps should be treated as known risks but still do not count against the budget (they are surfaced separately by the coordinator).
Read knowledge-graph.json (and, if needed, the query guidance in skills/building-java-knowledge-graph/SKILL.md) to understand the architecture and dependencies related to this feature. Also check for research files if available.
Load skills/writing-feature-spec/templates/spec-template.md for required sections.
Execute:
REQ-XXX where XXX is a 3-digit sequence number (001, 002, ...)REQ-001, REQ-002, REQ-003clarification.md are NOT unclear — use the user's answer (or the recorded default) and do not mark them.Write the specification to the assigned artifact path using the template structure, replacing placeholders with concrete details derived from the feature description while preserving section order and headings.
Report completion with spec file path, checklist results, and readiness for the next phase.
When pre-built research files are available (provided by a design/explore phase), use this alternate workflow instead of reading source code directly:
When research files exist, do NOT read project source files directly (source code, build files, config files). All codebase analysis is already in the research files.
Look for these files in the current working directory or as referenced in the task:
project-structure.md — functional domain list (REQUIRED)tech-stack.md — technology inventory (REQUIRED)data-model.md — key entities summary (optional)architecture-summary.md — substitute for direct knowledge graph reading (optional)*.md research files (optional)Use the functional domain list from project-structure.md to drive:
data-model.md directly (top 6–8)Write the spec section by section, appending each to the assigned artifact before moving to the next:
After spec is complete, append a quality checklist section at the end of the artifact:
When creating this spec from a user prompt:
Examples of reasonable defaults (don't ask about these):
Success criteria must be:
Good examples:
Bad examples (implementation-focused):
templates/spec-template.md — Specification document template with all mandatory sectionsdevelopment
Scan dependency manifests against known CVEs and remediate by upgrading vulnerable dependencies to patched versions, then rebuild and re-scan to confirm. Self-contained scan→fix→verify loop for any project with a dependency manifest. Use when: a cve-remediation task is dispatched; dependency set changed (version bump, new framework); assessment flagged vulnerable or EOL dependencies; or user asked to "fix CVEs", "patch vulnerabilities", or "dependency security". Triggers: "cve", "remediate cve", "fix cves", "patch vulnerable dependencies", "vulnerability scanning", "dependency security", "vulnerable dependencies", "security advisories", "npm audit", "pnpm audit", "maven audit", "gradle audit", "dependency scan", "vulnerability remediation". NOT for: security audit of auth/input/secrets/OWASP code paths (use security-review).
development
Generate dependency map diagram from project build files
documentation
Generate data architecture and persistence layer documentation with data model diagram
documentation
Generate core business workflow documentation with sequence diagram