Coding & Dev Tools Agent Skills
Coding agent skills teach AI agents repeatable engineering workflows: reviewing pull requests, writing tests, refactoring safely, and enforcing house style. Install one SKILL.md and your agent applies the same checklist every time, whether you use Claude Code, Cursor, Codex, or another agent.
Coding & Dev Tools
9,772 skills
mukul975 building-super-timelines-with-plaso
Build forensic super timelines from disk images using Plaso (log2timeline) and triage them in Timesketch.
24.6k · bundle
mukul975 detecting-container-escape-attempts
Detect container escape attempts using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.
24.6k · bundle
mukul975 detecting-modbus-protocol-anomalies
Detects anomalies in Modbus/TCP and Modbus RTU communications in industrial control systems using Zeek, Suricata, and custom Python analysis.
24.6k · bundle
mukul975 exploiting-insecure-deserialization
Identify and exploit insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications during authorized penetration tests.
24.6k · bundle
mukul975 hunting-credential-stuffing-attacks
Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins using statistical analysis on Splunk or raw log data.
24.6k · bundle
mukul975 hunting-for-dns-tunneling-with-zeek
Detect DNS tunneling and data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive query volume, long query lengths, and unusual DNS record types indicating covert channel communication.
24.6k · bundle
mukul975 hunting-for-supply-chain-compromise
Hunt for supply chain compromise indicators including trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts.
24.6k · bundle
mukul975 implementing-network-access-control
Enforces identity-based network access with 802.1X, RADIUS authentication, dynamic VLAN assignment, and endpoint posture assessment using PacketFence.
24.6k · bundle
mukul975 scanning-network-with-nmap-advanced
Performs advanced network reconnaissance using Nmap's scripting engine, timing controls, evasion techniques, and output parsing to discover hosts, enumerate services, detect vulnerabilities, and fingerprint operating systems across authorized target networks.
24.6k · bundle
mukul975 analyzing-active-directory-acl-abuse
Detect dangerous ACL misconfigurations in Active Directory by querying and parsing nTSecurityDescriptor attributes to identify GenericAll, WriteDACL, WriteOwner, and GenericWrite abuse paths.
24.6k · bundle
mukul975 analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
24.6k · bundle
mukul975 analyzing-malicious-url-with-urlscan
Investigate phishing URLs, credential harvesting pages, and malicious redirects using URLScan.io's safe browsing environment and API.
24.6k · bundle
mukul975 analyzing-network-traffic-of-malware
Analyzes malware-generated network traffic from PCAP files to identify C2 protocols, data exfiltration, DNS tunneling, and beaconing patterns using Wireshark, Zeek, Suricata, and Python.
24.6k · bundle
mukul975 analyzing-ransomware-payment-wallets
Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs. Identifies wallet clusters, tracks fund movement through mixers and exchanges, and supports law enforcement attribution.
24.6k · bundle
mukul975 analyzing-windows-shellbag-artifacts
Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.
24.6k · bundle
mukul975 building-incident-response-dashboard
Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline.
24.6k · bundle
mukul975 building-soc-playbook-for-ransomware
Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees.
24.6k · bundle
mukul975 conducting-malware-incident-response
Responds to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing eradication procedures.
24.6k · bundle
mukul975 detecting-container-drift-at-runtime
Detect unauthorized modifications to running containers by monitoring for binary execution drift, file system changes, and configuration deviations from the original container image.
24.6k · bundle
mukul975 detecting-lateral-movement-with-zeek
Analyze Zeek network logs to detect lateral movement techniques including SMB admin share access, DCE/RPC remote service creation, NTLM account spray, Kerberos anomalies, and large internal data transfers.
24.6k · bundle
mukul975 extracting-browser-history-artifacts
Extract and analyze browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge for forensic evidence of user web activity.
24.6k · bundle
mukul975 hunting-for-lateral-movement-via-wmi
Detect WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for WmiPrvSE.exe child process patterns, remote process execution, and WMI event subscription persistence.
24.6k · bundle
mukul975 implementing-alert-fatigue-reduction
Reduces SOC alert fatigue by tuning detection rules, consolidating duplicate alerts, implementing risk-based alerting, and measuring alert quality metrics to maintain analyst effectiveness.
24.6k · bundle
mukul975 implementing-rsa-key-pair-management
Generate, store, rotate, and manage RSA key pairs following NIST SP 800-57 guidelines, including key serialization, passphrase protection, and key strength validation.
24.6k · bundle
mukul975 performing-ioc-enrichment-automation
Automates multi-source enrichment of IPs, domains, URLs, and file hashes using VirusTotal, AbuseIPDB, Shodan, GreyNoise, URLScan.io, and MISP to provide contextual risk scoring and disposition recommendations for SOC analysts.
24.6k · bundle
mukul975 performing-jwt-none-algorithm-attack
Test JWT signature verification bypass by crafting tokens with the 'none' algorithm.
24.6k · bundle
mukul975 performing-sqlite-database-forensics
Recover deleted records, analyze freelist pages, WAL files, and unallocated space in SQLite databases for digital forensics and incident response.
24.6k · bundle
mukul975 scanning-container-images-with-grype
Scan container images for known vulnerabilities using Anchore Grype with SBOM-based matching and configurable severity thresholds.
24.6k · bundle
mukul975 analyzing-bootkit-and-rootkit-samples
Analyzes bootkit and rootkit malware that infects MBR, VBR, or UEFI firmware for pre-OS persistence, covering boot sector analysis, UEFI module inspection, and anti-rootkit detection.
24.6k · bundle
mukul975 analyzing-powershell-empire-artifacts
Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.
24.6k · bundle
mukul975 building-c2-redirector-infrastructure
Architect C2 redirectors with nginx and Apache, derive filter rules from malleable profiles, and apply OPSEC controls for resilient red-team infrastructure.
24.6k · bundle
mukul975 detecting-lateral-movement-in-network
Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.
24.6k · bundle
mukul975 detecting-living-off-the-land-attacks
Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks by monitoring process creation, command-line arguments, and parent-child relationships.
24.6k · bundle
mukul975 detecting-mimikatz-execution-patterns
Hunt for Mimikatz execution using command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.
24.6k · bundle
mukul975 detecting-process-hollowing-technique
Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.
24.6k · bundle
mukul975 performing-file-carving-with-foremost
Recover files from disk images and unallocated space using Foremost's header-footer signature carving to extract evidence regardless of file system state.
24.6k · bundle
Frequently asked questions
What are Coding & Dev Tools agent skills?
Coding agent skills teach AI agents repeatable engineering workflows: reviewing pull requests, writing tests, refactoring safely, and enforcing house style. Install one SKILL.md and your agent applies the same checklist every time, whether you use Claude Code, Cursor, Codex, or another agent.
Which Coding & Dev Tools skills are most installed?
Popular Coding & Dev Tools skills on SkillMD right now include detecting-container-escape-attempts, hunting-for-dns-tunneling-with-zeek, analyzing-malicious-url-with-urlscan. Rankings shift as installs change; sort this page by "Most downloaded" for the live list.
Do Coding & Dev Tools skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds add <owner>/<name>, or copy the file into your agent's skills directory.