agentsclimarketplace

Modernization audit

Skill AmanKrSahu/zeroday-auditor/skills/modernization-audit

An enterprise-grade, multi-specialist engineering audit plugin for Claude Code.

Install
npx -y skills add AmanKrSahu/zeroday-auditor --skill modernization-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when the user wants a focused dependency & modernization review — 'audit our dependencies', 'what's outdated', 'are our packages up to date / vulnerable', 'should we upgrade <framework>', 'modernize this codebase', 'assess cloud readiness', 'what should we migrate', 'where could we add AI'. Produces a single evidence-backed report (modernization-audit.md) covering dependency currency/vulnerabilities and modernization proposals with migration strategies. For a full multi-dimension audit use zeroday-auditor instead. Analysis only; never modifies source.

SKILL.md

3.6 KB, as published. Nobody here has run it

Modernization & Dependency Audit

Perform a focused dependency and modernization review as a Senior Cloud Infrastructure Engineer + Principal Platform Engineer + Principal Software Architect. Output one self-contained report, modernization-audit.md, in the repository root. Analysis only — never modify source.

Be factual about versions. Check the actual installed/declared versions against current releases before claiming something is outdated — read the manifest and lockfile, and where possible the release/advisory data (use a docs/web lookup or npm outdated/pip list --outdated style reasoning from the lockfile). An "upgrade X" recommendation with no version evidence is worthless. If you can't confirm currency or a CVE, say "Insufficient evidence to conclude."

Workflow

  1. Inventory the stack. Read the package manifest(s) and lockfile, runtime/engine versions (Dockerfile base image, .nvmrc, engines), framework config, CI/CD, and deployment/infra files. Establish exactly what versions are in use.
  2. Dispatch specialist passes (concurrently) via audit-specialist (fallback general-purpose), READ-ONLY, returning evidence with file:line:
    • Dependency currency & risk — outdated majors, deprecated/unmaintained packages, known-vulnerable versions (cross-reference advisories), duplicate/unused deps, lockfile hygiene, runtime EOL (e.g. Node/Python version support).
    • Framework & language modernization — newer framework capabilities left unused, legacy patterns superseded by language features, tooling upgrades (build/test/lint).
    • Platform & future-proofing — cloud readiness, containerization/deployment posture, observability, horizontal scalability, and genuinely-fitting AI opportunities.
  3. Verify the high-impact claims yourself — confirm a flagged version is actually behind and the upgrade path is real (breaking changes, migration effort). Reconcile duplicates.
  4. Write modernization-audit.md (structure below).

Finding format

Give each proposal a stable ID MOD-NNN with: Title · Priority · Current State (with the exact version/evidence, file:line) · Recommended State · Benefits · Migration Strategy · Risk · Estimated Effort. For a security-relevant outdated dependency, also cite the CVE/advisory.

Report structure

# <Project> — Modernization & Dependency Audit
(scope, method, date)
# Stack Inventory   (table: component · current version · latest · gap · risk)
# Dependency Findings   (outdated / vulnerable / deprecated / unused — MOD-* items)
# Framework & Language Modernization   (MOD-* items)
# Platform & Future-Proofing   (cloud readiness, observability, scaling, AI opportunities)
# Prioritized Upgrade Plan   (safe/isolated upgrades first; batch breaking changes; note what needs a test net first)
# Summary   (top 3 upgrades by ROI/risk)

Finish by telling the user the most urgent upgrades (especially any security-relevant ones) and the safest order to apply them. Confirm source is untouched (git status shows only modernization-audit.md).

Gives 0 of the 12 instructions most audit compliance skills give

Counted across 936 of the 1,487 authors here whose files we hold, read 2026-08-06

  • group findings by severityin 44 of 936
  • Fetch latest guidelines before each reviewin 43 of 936, across 3 files
  • Check files against all fetched rulesin 42 of 936, across 2 files
  • Output findings in terse file:line formatin 41 of 936, across 3 files
  • Ask user which files to review if none specifiedin 41 of 936, across 3 files
  • Read specified files or prompt user for filesin 39 of 936, across 1 file
  • generate the audit reportin 39 of 936, across 36 files
  • assign a severity to every findingin 25 of 936
  • run automated accessibility scansin 23 of 936, across 13 files
  • map findings to WCAG criteriain 20 of 936, across 10 files
  • confirm audit scopein 19 of 936, across 9 files
  • check title tags and meta descriptions for uniquenessin 19 of 936, across 5 files

Said here and by no other author read

  • output one self-contained report named modernization-audit.md
  • state insufficient evidence if currency is unconfirmable
  • inventory the stack from manifests lockfiles and config
  • dispatch specialist read-only passes returning evidence
  • verify high-impact claims yourself before writing
  • give each proposal a stable ID MOD-NNN

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.