plugins/github-copilot-modernization/skills/guidelines/SKILL.md
Collection of framework-to-framework migration rules and transformation patterns (e.g., Struts→Spring MVC, JSP→Thymeleaf, EJB→Spring Boot). Triggers: "check migration guidelines", "look up transformation rules", "find Struts-to-Spring patterns", "apply migration conventions", "conversion rules for X→Y". Also consumed automatically by breaking-down-tasks and implementing-code during migration workflows. NOT for: direct execution — other skills scan this directory.
npx skillsauth add microsoft/github-copilot-modernization guidelinesInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
You MUST consider the user input before proceeding (if not empty).
Guidelines are curated, domain-specific knowledge bases providing:
skills/guidelines/
├── SKILL.md # This file - lookup mechanism
├── struts-to-spring/ # Struts 2 → Spring Boot 3.x
│ └── SKILL.md
└── {domain}/ # Future guideline domains
└── SKILL.md
When other skills need guideline lookup:
skills/guidelines/ subdirectories for matching patterns.| Workflow Step | Guideline Application | |---------------|----------------------| | Specification | Domain constraints, scope boundaries | | Planning | Technology decisions, architecture patterns | | Tasks | Transformation tasks, file-by-file changes | | Implementation | Code transformation rules, test patterns | | Completeness | Validation checklists, coverage criteria |
skills/guidelines/{domain}/SKILL.md with:
When guidelines are applied, document in the relevant artifact:
## Applied Guidelines
- **Guideline**: struts-to-spring
- **Rules Used**: convert-action-to-controller, convert-validation
- **Reference**: skills/guidelines/struts-to-spring/SKILL.md
development
Scan dependency manifests against known CVEs and remediate by upgrading vulnerable dependencies to patched versions, then rebuild and re-scan to confirm. Self-contained scan→fix→verify loop for any project with a dependency manifest. Use when: a cve-remediation task is dispatched; dependency set changed (version bump, new framework); assessment flagged vulnerable or EOL dependencies; or user asked to "fix CVEs", "patch vulnerabilities", or "dependency security". Triggers: "cve", "remediate cve", "fix cves", "patch vulnerable dependencies", "vulnerability scanning", "dependency security", "vulnerable dependencies", "security advisories", "npm audit", "pnpm audit", "maven audit", "gradle audit", "dependency scan", "vulnerability remediation". NOT for: security audit of auth/input/secrets/OWASP code paths (use security-review).
development
Generate dependency map diagram from project build files
documentation
Generate data architecture and persistence layer documentation with data model diagram
documentation
Generate core business workflow documentation with sequence diagram