Purpose
Turn raw application metadata (age, language, dependency count, test coverage, deployment frequency, support burden) into a prioritized risk register that pinpoints technical debt hotspots and tells leadership exactly which applications to remediate first and why. Replaces gut-feel modernization debates with a defensible, scored ranking.
When to Use
Invoke this skill when the user asks to:
- Audit an application portfolio for risk and technical debt
- Identify which applications are the biggest technical debt hotspots
- Prioritize modernization, refactoring, or remediation work across many apps
- Build a risk register for engineering or architecture leadership
- Justify a modernization budget or decommission decision with data
- Assess whether a legacy application should be maintained, refactored, or retired
Inputs Required
Before starting, collect:
- Application list: Each application by name, ideally with a one-line description of its business function
- Age / last major rewrite: Years since build or last significant modernization, per app
- Language / framework and version: Primary stack and whether the version is current, in support, or end-of-life
- Dependency count and staleness: Number of dependencies and how many are outdated or unsupported (if known)
- Test coverage: Approximate automated test coverage percentage, or "none/unknown"
- Deployment frequency: How often the app ships (per day / week / month / rarely)
- Support burden: Incident volume, on-call load, or maintenance hours per month
- Business criticality: Revenue impact or tier (mission-critical / important / peripheral)
If test coverage, dependency staleness, or business criticality is unknown for an app, score it conservatively (assume higher risk) and flag the missing data as a data-quality gap in the output.
Instructions
Step 1: Score Each Application Across Six Risk Dimensions
For every application, assign a 1–5 score per dimension (1 = healthy, 5 = critical risk). Use these calibration anchors:
Dimension 1 — Stack Currency
- 1: Current, actively supported language/framework version
- 3: One major version behind or approaching end-of-support
- 5: End-of-life stack, no security patches, or unsupported runtime
Dimension 2 — Test Safety Net
- 1: >70% coverage with CI gates
- 3: 30–70% coverage or partial automation
- 5: <10% coverage, manual-only, or unknown
Dimension 3 — Dependency Health
- 1: Few dependencies, all current
- 3: Moderate count with some outdated packages
- 5: Heavy dependency graph with unsupported or vulnerable packages
Dimension 4 — Change Velocity
- 1: Ships frequently (weekly+), low friction
- 3: Ships monthly, moderate friction
- 5: Rarely ships or deploys are high-risk manual events (fear-to-touch code)
Dimension 5 — Support Burden
- 1: Low incident volume, minimal on-call impact
- 3: Recurring incidents or noticeable maintenance drag
- 5: Frequent incidents, high on-call load, or firefighting mode
Dimension 6 — Age / Architectural Drift
- 1: Recently built or modernized (<3 years)
- 3: 3–7 years, some architectural erosion
- 5: 8+ years, no major rewrite, accumulated architectural drift
Step 2: Calculate Composite Risk Score
- Sum the six dimension scores into a Raw Risk Score (range 6–30).
- Multiply by a business-criticality weight: mission-critical ×1.5, important ×1.2, peripheral ×1.0.
- Record the resulting Weighted Risk Score — this drives ranking. Rationale: a broken peripheral tool matters less than a fragile revenue system.
Step 3: Assign Remediation Urgency Tiers
Map each weighted score to a tier:
- Tier 1 — Critical (act this quarter): Weighted score ≥ 30, OR any single dimension = 5 on a mission-critical app (especially Stack Currency or Dependency Health with security exposure)
- Tier 2 — High (plan within 6 months): Weighted score 20–29
- Tier 3 — Monitor (track, no immediate action): Weighted score 12–19
- Tier 4 — Healthy (maintain as-is): Weighted score < 12
Step 4: Identify Technical Debt Hotspots
Beyond scores, flag structural patterns across the portfolio:
- Fear-to-touch apps: High age + low test coverage + rare deploys (dimensions 2, 4, 6 all high) — the most dangerous debt because it compounds silently
- Security time bombs: End-of-life stack or unsupported dependencies on any internet-facing or mission-critical app
- Support sinks: High support burden dragging engineering capacity away from roadmap work
- Concentration risk: Multiple critical apps sharing the same end-of-life stack — a single dependency failure could cascade
Step 5: Recommend Remediation Strategy Per Tier 1 and Tier 2 App
For each Tier 1 and Tier 2 application, recommend one action and a rationale:
- Refactor / modernize in place: High business value, salvageable architecture
- Rewrite / replatform: High value but architecturally unsalvageable
- Rehost / patch and stabilize: Buys time while a longer decision is made
- Decommission / consolidate: Low value, high burden — retire or fold into another system
- Increase test coverage first: When the app is high-value but too risky to touch until a safety net exists
Step 6: Sequence the Roadmap
Produce a prioritized sequence:
- Quick wins (0–90 days): Low-effort, high-risk-reduction items — dependency upgrades, adding CI gates, patching end-of-life runtimes
- Strategic bets (3–12 months): High-effort modernization or replatform work on Tier 1 mission-critical apps
- Sequencing logic: Address security time bombs and concentration risk before elective modernization; build test coverage on fear-to-touch apps before refactoring them
Output Format
- Structure: A risk register table (all apps, sorted by Weighted Risk Score descending) followed by hotspot callouts, per-app remediation recommendations for Tier 1/2, and a sequenced roadmap
- Length: 900–1,400 words plus the register table (scales with portfolio size)
- Format: Table for the register; structured bullets for hotspots and roadmap
- Sections: Risk Register Table → Urgency Tier Summary → Technical Debt Hotspots → Remediation Recommendations (Tier 1 & 2) → Sequenced Roadmap (Quick Wins / Strategic Bets) → Data-Quality Gaps
- Tone: Enterprise architect briefing engineering leadership — analytical, decisive, and cost-of-inaction aware. No hedging on rankings.
Quality Checklist
Before delivering output, verify:
- [ ] Every application received all six dimension scores (1–5) — none skipped
- [ ] Weighted Risk Score is computed with the business-criticality multiplier applied
- [ ] The register table is sorted by Weighted Risk Score, highest first
- [ ] Every app is assigned exactly one urgency tier consistent with its score and the tier thresholds
- [ ] Each Tier 1 and Tier 2 app has a specific remediation strategy and rationale — not just "modernize"
- [ ] Any app with missing input data is flagged in the Data-Quality Gaps section and scored conservatively
Notes
- The most dangerous debt is rarely the oldest app — it's the high-criticality app with no test safety net that nobody wants to touch. Weight the ranking toward compounding risk, not just age.
- Concentration risk (many apps on one dying stack) is easy to miss when scoring apps individually — always scan the portfolio horizontally for shared end-of-life dependencies.
- Recommend that decommission candidates be validated with a usage audit before retirement — "peripheral" apps sometimes hide critical downstream consumers.
- Quick wins first builds leadership confidence and frees engineering capacity to fund the strategic bets — sequence accordingly.
How to use this skill
This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.
Installing in Claude Code:
~/.claude/skills/<folder-name>/SKILL.md— auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)<your-project>/.claude/skills/<folder-name>/SKILL.md— auto-loads only when working in that project (recommended for project-specific skills)
Restart Claude Code or open a new session to register.
Using in Claude.ai, ChatGPT, Gemini, or other AI tools:
- Drag this file into a new chat, or copy and paste its contents
- Send your task or request as your next message — the AI will apply the skill where it fits
For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills