Coding & Dev Tools Agent Skills
Coding agent skills teach AI agents repeatable engineering workflows: reviewing pull requests, writing tests, refactoring safely, and enforcing house style. Install one SKILL.md and your agent applies the same checklist every time, whether you use Claude Code, Cursor, Codex, or another agent.
Coding & Dev Tools
9,772 skills
mukul975 detecting-ransomware-encryption-behavior
Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring, and behavioral heuristics.
24.6k · bundle
mukul975 exploiting-bgp-hijacking-vulnerabilities
Simulates BGP hijacking attacks in isolated lab environments to test RPKI deployment, route origin validation, and BGP monitoring defenses against prefix hijacking and route leak attacks.
24.6k · bundle
mukul975 hunting-bootkits-in-efi-system-partition
Baseline the EFI System Partition and hunt malicious EFI binaries (ESPecter, BlackLotus, Bootkitty, Glupteba) by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and detecting anomalous non-EFI files.
24.6k · bundle
mukul975 hunting-for-living-off-the-land-binaries
Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading detection.
24.6k · bundle
mukul975 hunting-for-process-injection-techniques
Detect process injection techniques (T1055) including CreateRemoteThread, process hollowing, and DLL injection via Sysmon Event IDs 8 and 10 and EDR process telemetry.
24.6k · bundle
mukul975 hunting-for-registry-run-key-persistence
Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry queries to identify malicious auto-start entries.
24.6k · bundle
mukul975 implementing-log-forwarding-with-fluentd
Configure Fluentd and Fluent Bit for centralized log aggregation, routing, filtering, and enrichment across distributed infrastructure.
24.6k · bundle
mukul975 implementing-pci-dss-compliance-controls
Implement PCI DSS 4.0.1 compliance controls across all 12 requirements, including scoping, network security, data protection, access controls, monitoring, and governance.
24.6k · bundle
mukul975 implementing-scim-provisioning-with-okta
Build a SCIM 2.0-compliant API server and integrate it with Okta for automated user provisioning, deprovisioning, profile updates, and group management.
24.6k · bundle
mukul975 performing-initial-access-with-evilginx3
Conduct authorized red team initial access using EvilGinx3 adversary-in-the-middle phishing to capture session tokens and bypass multi-factor authentication.
24.6k · bundle
mukul975 performing-lateral-movement-with-wmiexec
Execute remote commands on Windows targets using WMI-based lateral movement techniques, including Impacket wmiexec.py, CrackMapExec, and native PowerShell WMI commands for red team engagements.
24.6k · bundle
mukul975 securing-remote-access-to-ot-environment
Implements secure remote access architecture for OT/ICS environments with jump servers, MFA, session recording, and privileged access management.
24.6k · bundle
mukul975 validating-backup-integrity-for-recovery
Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.
24.6k · bundle
mukul975 validating-tpm-measured-boot-attestation
Verify TPM measured boot integrity and remote attestation using tpm2-tools, including PCR reading, event log replay, quote generation and verification, and golden baseline comparison.
24.6k · bundle
mukul975 analyzing-persistence-mechanisms-in-linux
Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring.
24.6k · bundle
mukul975 analyzing-powershell-script-block-logging
Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques.
24.6k · bundle
mukul975 analyzing-windows-lnk-files-for-artifacts
Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.
24.6k · bundle
mukul975 conducting-domain-persistence-with-dcsync
Extract Active Directory credentials via DCSync attacks and establish domain persistence by dumping KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.
24.6k · bundle
mukul975 conducting-full-scope-red-team-engagement
Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities.
24.6k · bundle
mukul975 detecting-exfiltration-over-dns-with-zeek
Analyze Zeek dns.log files to detect DNS-based data exfiltration by computing Shannon entropy, flagging long subdomain labels, and identifying anomalous query patterns.
24.6k · bundle
mukul975 detecting-living-off-the-land-with-lolbas
Detect abuse of legitimate Windows binaries (LOLBins) like certutil, regsvr32, mshta, and rundll32 using process telemetry, Sigma rules, and parent-child process analysis.
24.6k · bundle
mukul975 detecting-suspicious-powershell-execution
Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.
24.6k · bundle
mukul975 eradicating-malware-from-infected-systems
Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.
24.6k · bundle
mukul975 hunting-for-command-and-control-beaconing
Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.
24.6k · bundle
mukul975 hunting-for-unusual-service-installations
Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.
24.6k · bundle
mukul975 implementing-anti-ransomware-group-policy
Hardens Windows Active Directory environments against ransomware by configuring Group Policy Objects with AppLocker rules, Controlled Folder Access, Attack Surface Reduction rules, and lateral movement restrictions.
24.6k · bundle
mukul975 implementing-jwt-signing-and-verification
Implement secure JWT signing and verification with HMAC-SHA256, RSA-PSS, and EdDSA, including token expiration, claims validation, and defense against common JWT attacks.
24.6k · bundle
mukul975 implementing-mtls-for-zero-trust-services
Generates CA and service certificates, then configures mutual TLS authentication between microservices using Python's cryptography and ssl modules.
24.6k · bundle
mukul975 investigating-ransomware-attack-artifacts
Identify, collect, and analyze ransomware attack artifacts to determine the variant, initial access vector, encryption scope, and recovery options.
24.6k · bundle
mukul975 performing-arp-spoofing-attack-simulation
Simulates ARP spoofing attacks in authorized lab or pentest environments using arpspoof, Ettercap, and Scapy to demonstrate man-in-the-middle risks, test network detection capabilities, and validate ARP inspection countermeasures.
24.6k · bundle
mukul975 performing-credential-access-with-lazagne
Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.
24.6k · bundle
mukul975 testing-for-open-redirect-vulnerabilities
Identify and test open redirect vulnerabilities in web applications by analyzing URL redirection parameters, bypass techniques, and exploitation chains for phishing and token theft.
24.6k · bundle
mukul975 testing-for-xml-injection-vulnerabilities
Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks.
24.6k · bundle
mukul975 testing-for-xxe-injection-vulnerabilities
Discover and exploit XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfiltrate data during authorized penetration tests.
24.6k · bundle
mukul975 analyzing-browser-forensics-with-hindsight
Extract and analyze Chromium-based browser artifacts using Hindsight to reconstruct user web activity for forensic investigations.
24.6k · bundle
mukul975 analyzing-lnk-file-and-jump-list-artifacts
Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing.
24.6k · bundle
Frequently asked questions
What are Coding & Dev Tools agent skills?
Coding agent skills teach AI agents repeatable engineering workflows: reviewing pull requests, writing tests, refactoring safely, and enforcing house style. Install one SKILL.md and your agent applies the same checklist every time, whether you use Claude Code, Cursor, Codex, or another agent.
Which Coding & Dev Tools skills are most installed?
Popular Coding & Dev Tools skills on SkillMD right now include exploiting-bgp-hijacking-vulnerabilities, eradicating-malware-from-infected-systems, performing-credential-access-with-lazagne. Rankings shift as installs change; sort this page by "Most downloaded" for the live list.
Do Coding & Dev Tools skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds add <owner>/<name>, or copy the file into your agent's skills directory.