All skills & plugins / Claude Code official plugins

code-modernization

Guided modernization for any legacy codebase: start with /modernize, get an assessment, an interactive map, the business rules mined from the code, and a plan you approve, then an upgrade, a rewrite or a rebuild with independent proof that the new code behaves like the old. Includes security hardening, a one-page report, specialist agents, and an optional live progress pane (early access).

Pre-approved tools

Shell (any command). Tools listed in allowed-tools (or an agent's tools) can be used without a permission prompt while the skill is active, depending on your agent and settings.

Declared in agents/scaffolder.md, agents/test-engineer.md, agents/legacy-analyst.md, agents/business-rules-extractor.md, agents/security-auditor.md, agents/version-delta-analyst.md.

Hooks

Hooks run automatically on these agent events, without you invoking the skill: PostToolUseFailure, SessionStart, Stop, StopFailure, UserPromptSubmit.

MCP servers and apps

None.

Bundled code

59 code files (JavaScript, Python, Shell, TypeScript); first 40 listed:

• code-modernization/tests/logic.test.ts
• code-modernization/tests/hostile.test.ts
• code-modernization/tests/stacks.test.ts
• code-modernization/tests/register.test.ts
• code-modernization/tests/verification.test.ts
• code-modernization/tests/mount.test.ts
• tests/fixtures/world.ts
• tests/fixtures/workspace.ts
• tests/fixtures/stacks.ts
• tests/fixtures/inputs.ts
• code-modernization/scripts/make_shards.py
• code-modernization/scripts/compare.py
• code-modernization/scripts/render_rules.py
• code-modernization/scripts/uplift_checks.py
• code-modernization/scripts/trace_rules.py
• and 44 more

Network calls

No HTTP or socket call pattern found in the code.

Starts other programs

14 files. First match per file:

• plugins/code-modernization/scripts/tests/test_report_tools.py:614

  for word in ("innerHTML", "outerHTML", "insertAdjacentHTML", "document.write", "eval(", "new Function", "setTimeout(\"", "fetch(", "XMLHttpR

• plugins/code-modernization/scripts/tests/test_telemetry.py:476

  done = subprocess.run([sys.executable, "-c", code], input=json.dumps({"cwd": self.ws}), capture_output=True, text=True, timeout=20,

• plugins/code-modernization/scripts/tests/test_rules_tools.py:14

  return subprocess.run([sys.executable, os.path.join(SCRIPTS, script), *args], capture_output=True, text=True)

• plugins/code-modernization/scripts/tests/test_proof_tools.py:487

  with um.patch("subprocess.Popen", refuse), um.patch("os.system", refuse), um.patch("os.popen", refuse):

• plugins/code-modernization/hooks/tests-run.ts:45

  const pytest = /=+\s*((?:\d+\s+\w+,?\s*)+)\s+in\s+[\d.]+s/.exec(output)

Credentials referenced

No key, token or secret environment variable found in code or MCP config.

Static scan of commit 41f619d on 2026-10-27. Signals are patterns found in the files, not a verdict: a network call can be the whole point of a skill. Read the linked lines before you decide. How the scan works.