Coding & Dev Tools Agent Skills
Coding agent skills teach AI agents repeatable engineering workflows: reviewing pull requests, writing tests, refactoring safely, and enforcing house style. Install one SKILL.md and your agent applies the same checklist every time, whether you use Claude Code, Cursor, Codex, or another agent.
Coding & Dev Tools
9,772 skills
mukul975 detecting-pass-the-hash-attacks
Hunt for Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons where Kerberos is expected, and correlating with credential dumping indicators.
24.6k · bundle
mukul975 detecting-service-account-abuse
Detect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.
24.6k · bundle
mukul975 detecting-stuxnet-style-attacks
Detect sophisticated cyber-physical attacks that modify PLC logic while spoofing sensor readings, covering PLC integrity monitoring, process anomaly detection, and multi-stage attack chain detection.
24.6k · bundle
mukul975 implementing-saml-sso-with-okta
Configure Okta as a SAML 2.0 Identity Provider and implement SP-initiated and IdP-initiated SSO flows with attribute mapping, assertion encryption, and security hardening.
24.6k · bundle
mukul975 performing-kerberoasting-attack
Enumerate Active Directory service accounts, request Kerberos TGS tickets, and crack them offline to assess password strength and privilege escalation paths.
24.6k · bundle
mukul975 performing-purple-team-exercise
Coordinates purple team exercises by running MITRE ATT&CK-mapped attack scenarios with real-time detection testing and collaborative gap remediation.
24.6k · bundle
mukul975 performing-ssl-stripping-attack
Simulates SSL stripping attacks using sslstrip, Bettercap, and mitmproxy in authorized environments to test HSTS enforcement, certificate validation, and HTTPS upgrade mechanisms.
24.6k · bundle
mukul975 analyzing-linux-system-artifacts
Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity.
24.6k · bundle
mukul975 deobfuscating-javascript-malware
Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic.
24.6k · bundle
mukul975 detecting-malicious-npm-packages
Triage npm packages for install-script malware, exfiltration, and worming behavior using GuardDog, manual inspection, and safe detonation.
24.6k · bundle
mukul975 detecting-typosquatting-packages
Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation using edit-distance, keyboard-proximity, and known-target corpus matching with typomania, OSSGadget, and pypi-scan.
24.6k · bundle
mukul975 hunting-for-shadow-copy-deletion
Hunt for Volume Shadow Copy deletion activity that indicates ransomware preparation or anti-forensics by monitoring vssadmin, wmic, and PowerShell shadow copy commands.
24.6k · bundle
mukul975 reverse-engineering-rust-malware
Analyze Rust-compiled malware binaries using IDA Pro and Ghidra, with techniques for extracting crate dependencies, non-null-terminated strings, and Rust-specific control flow patterns.
24.6k · bundle
mukul975 analyzing-disk-image-with-autopsy
Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.
24.6k · bundle
mukul975 analyzing-heap-spray-exploitation
Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.
24.6k · bundle
mukul975 attacking-entra-id-with-roadtools
Enumerate Microsoft Entra ID tenants using ROADrecon and acquire/exchange tokens with roadtx for authorized red-team operations.
24.6k · bundle
mukul975 conducting-pass-the-ticket-attack
Extract Kerberos tickets from LSASS memory, inject them into an attacker session, and perform lateral movement to access remote systems as the impersonated user.
24.6k · bundle
mukul975 detecting-dll-sideloading-attacks
Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.
24.6k · bundle
mukul975 detecting-dnp3-protocol-anomalies
Detect anomalies in DNP3 protocol communications used in SCADA systems by monitoring for unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic patterns using deep packet inspection and machine learning approaches.
24.6k · bundle
mukul975 detecting-mobile-malware-behavior
Analyzes mobile applications for malicious behavior through static analysis, runtime monitoring, and network traffic inspection to identify malware indicators.
24.6k · bundle
mukul975 detecting-pass-the-ticket-attacks
Detect Kerberos Pass-the-Ticket attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM.
24.6k · bundle
mukul975 exploiting-http-request-smuggling
Detect and exploit HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.
24.6k · bundle
mukul975 hunting-for-cobalt-strike-beacons
Detect Cobalt Strike beacon network activity using TLS certificate signatures, JA3/JA3S/JARM fingerprints, HTTP C2 profile matching, beacon jitter analysis, and named pipe detection via Zeek, Suricata, and Python PCAP analysis.
24.6k · bundle
mukul975 hunting-for-dcom-lateral-movement
Detect DCOM-based lateral movement by correlating Sysmon process creation and network connection events, WMI event analysis, and RPC endpoint mapper traffic to identify abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects.
24.6k · bundle
mukul975 implementing-siem-use-case-tuning
Reduce SIEM alert fatigue by systematically tuning detection rules in Splunk and Elastic, using statistical baselines, whitelists, and precision/recall metrics.
24.6k · bundle
mukul975 performing-malware-ioc-extraction
Analyze malicious software to extract actionable indicators of compromise including file hashes, network indicators, registry modifications, and embedded strings, formatted as STIX 2.1 indicators.
24.6k · bundle
mukul975 recovering-from-ransomware-attack
Executes structured recovery from a ransomware incident following NIST and CISA frameworks, including environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized system restoration from verified backups, credential reset, and validation against re-infection.
24.6k · bundle
mukul975 testing-for-broken-access-control
Systematically test web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.
24.6k · bundle
mukul975 testing-for-host-header-injection
Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.
24.6k · bundle
mukul975 analyzing-uefi-bootkit-persistence
Analyzes UEFI bootkit persistence mechanisms including firmware implants, ESP modifications, Secure Boot bypass techniques, and UEFI variable manipulation. Covers detection of known bootkit families, forensic inspection, and integrity verification.
24.6k · bundle
mukul975 configuring-pfsense-firewall-rules
Guides the configuration of pfSense firewall rules, NAT policies, VPN tunnels, and traffic shaping to enforce network segmentation and protect network zones.
24.6k · bundle
mukul975 performing-dns-tunneling-detection
Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality using scapy for packet capture analysis.
24.6k · bundle
mukul975 performing-steganography-detection
Detect and extract hidden data embedded in images, audio, and other media files using steganalysis tools to uncover covert communication channels.
24.6k · bundle
mukul975 abusing-dpapi-for-credential-access
Extract DPAPI-protected secrets such as credentials and browser data from Windows systems during authorized penetration tests.
24.6k · bundle
mukul975 auditing-entra-id-with-aadinternals
Run Microsoft Entra ID tenant reconnaissance, token acquisition and manipulation, and federation backdoor testing with the AADInternals PowerShell toolkit to validate identity-attack resilience.
24.6k · bundle
mukul975 auditing-uefi-firmware-with-chipsec
Assess platform firmware security using Intel CHIPSEC: verify SPI flash write protection, BIOS lock, SMM/SMRR, Secure Boot variables, dump SPI flash, and triage UEFI variables for firmware-level threats.
24.6k · bundle
Frequently asked questions
What are Coding & Dev Tools agent skills?
Coding agent skills teach AI agents repeatable engineering workflows: reviewing pull requests, writing tests, refactoring safely, and enforcing house style. Install one SKILL.md and your agent applies the same checklist every time, whether you use Claude Code, Cursor, Codex, or another agent.
Which Coding & Dev Tools skills are most installed?
Popular Coding & Dev Tools skills on SkillMD right now include detecting-service-account-abuse, hunting-for-dcom-lateral-movement, detecting-stuxnet-style-attacks. Rankings shift as installs change; sort this page by "Most downloaded" for the live list.
Do Coding & Dev Tools skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds add <owner>/<name>, or copy the file into your agent's skills directory.