Coding & Dev Tools Agent Skills
Coding agent skills teach AI agents repeatable engineering workflows: reviewing pull requests, writing tests, refactoring safely, and enforcing house style. Install one SKILL.md and your agent applies the same checklist every time, whether you use Claude Code, Cursor, Codex, or another agent.
Coding & Dev Tools
9,772 skills
mukul975 analyzing-packed-malware-with-upx-unpacker
Identifies and unpacks UPX-packed and other packed malware samples to expose the original executable code for static analysis.
24.6k · bundle
mukul975 analyzing-ransomware-encryption-mechanisms
Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to assess decryption feasibility, identify implementation weaknesses, and support recovery efforts.
24.6k · bundle
mukul975 building-role-mining-for-rbac-optimization
Apply bottom-up and top-down role mining techniques to discover optimal RBAC roles from existing user-permission assignments, reducing role explosion and enforcing least privilege.
24.6k · bundle
mukul975 deploying-cloudflare-access-for-zero-trust
Deploy Cloudflare Access with Cloudflare Tunnel to provide zero trust access to self-hosted and private applications, configuring identity-aware access policies, device posture checks, and WARP client enrollment for VPN replacement.
24.6k · bundle
mukul975 detecting-arp-poisoning-in-network-traffic
Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, Wireshark analysis, and custom Python monitoring scripts to protect against man-in-the-middle interception.
24.6k · bundle
mukul975 detecting-modbus-command-injection-attacks
Detect command injection attacks against Modbus TCP/RTU protocol in ICS environments by monitoring for unauthorized write operations, anomalous function codes, malformed frames, and deviations from established communication baselines.
24.6k · bundle
mukul975 implementing-gdpr-data-protection-controls
Implement technical and organizational measures required by GDPR, including data mapping, DPIAs, data subject rights management, breach notification, and cross-border transfer mechanisms.
24.6k · bundle
mukul975 implementing-log-integrity-with-blockchain
Build an append-only log integrity chain using SHA-256 hash chaining for tamper detection. Each log entry is hashed with the previous entry's hash to create a blockchain-like structure where modifying any entry invalidates all subsequent hashes.
24.6k · bundle
mukul975 implementing-mitre-attack-coverage-mapping
Map MITRE ATT&CK coverage to identify detection gaps, prioritize rule development, and measure SOC detection maturity against adversary techniques.
24.6k · bundle
mukul975 implementing-ot-incident-response-playbook
Develop and implement OT-specific incident response playbooks aligned with SANS PICERL framework, IEC 62443, and NIST SP 800-82 that address unique ICS challenges including safety-critical systems, limited downtime tolerance, and coordination between IT SOC, OT engineering, and plant operations teams.
24.6k · bundle
mukul975 performing-authenticated-scan-with-openvas
Configure and execute authenticated vulnerability scans using OpenVAS/Greenbone Vulnerability Management with SSH and SMB credentials for comprehensive host-level assessment.
24.6k · bundle
mukul975 performing-dark-web-monitoring-for-threats
Scan Tor hidden services, underground forums, paste sites, and dark web marketplaces to identify threats targeting an organization, including leaked credentials, data breaches, and threat actor discussions.
24.6k · bundle
mukul975 performing-deception-technology-deployment
Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates.
24.6k · bundle
mukul975 performing-network-packet-capture-analysis
Analyze network packet captures (PCAP/PCAPNG) using Wireshark, tshark, tcpdump, and Python to reconstruct communications, extract files, and identify malicious traffic.
24.6k · bundle
mukul975 analyzing-malware-persistence-with-autoruns
Identify and analyze malware persistence mechanisms on Windows systems using Sysinternals Autoruns, covering registry keys, scheduled tasks, services, drivers, and startup locations.
24.6k · bundle
mukul975 analyzing-tls-certificate-transparency-logs
Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance.
24.6k · bundle
mukul975 conducting-memory-forensics-with-volatility
Analyze RAM dumps with Volatility 3 to detect malware, process injection, network connections, and credential theft during incident response.
24.6k · bundle
mukul975 configuring-network-segmentation-with-vlans
Designs and implements VLAN-based network segmentation on managed switches to isolate network zones, enforce access control between segments, and reduce the attack surface by limiting lateral movement paths in enterprise network environments.
24.6k · bundle
mukul975 configuring-zscaler-private-access-for-ztna
Replace traditional VPNs with zero trust network access by deploying Zscaler Private Access, configuring App Connectors, defining application segments, and setting identity-based access policies.
24.6k · bundle
mukul975 deobfuscating-powershell-obfuscated-malware
Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.
24.6k · bundle
mukul975 detecting-dcsync-attack-in-active-directory
Detect DCSync attacks by monitoring Active Directory replication requests from non-domain-controller accounts via Event ID 4662 and associated GUIDs.
24.6k · bundle
mukul975 detecting-deepfake-audio-in-vishing-attacks
Detects AI-generated deepfake audio used in voice phishing (vishing) attacks by extracting spectral features and classifying samples with machine learning models.
24.6k · bundle
mukul975 exploiting-active-directory-with-bloodhound
Graph-based Active Directory reconnaissance tool that reveals hidden relationships and attack paths from compromised accounts to high-value targets like Domain Admins.
24.6k · bundle
mukul975 generating-forensic-timelines-with-hayabusa
Generate Sigma-based forensic timelines from Windows EVTX files using Hayabusa for incident response triage.
24.6k · bundle
mukul975 hunting-for-registry-persistence-mechanisms
Hunt for registry-based persistence mechanisms including Run keys, Winlogon modifications, IFEO injection, and COM hijacking in Windows environments.
24.6k · bundle
mukul975 implementing-siem-correlation-rules-for-apt
Detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts using Splunk SPL and Sigma rule format.
24.6k · bundle
mukul975 parsing-artifacts-with-eric-zimmerman-tools
Parse Windows forensic artifacts including registry, prefetch, shellbags, MFT, and event logs using Eric Zimmerman's tools and analyze results in Timeline Explorer.
24.6k · bundle
mukul975 performing-network-forensics-with-wireshark
Capture and analyze network traffic using Wireshark and tshark to reconstruct network events, extract artifacts, and identify malicious communications.
24.6k · bundle
mukul975 performing-privileged-account-access-review
Conduct systematic reviews of privileged accounts to validate access rights, identify excessive permissions, and enforce least privilege across PAM infrastructure.
24.6k · bundle
mukul975 analyzing-cobalt-strike-beacon-configuration
Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.
24.6k · bundle
mukul975 analyzing-cobaltstrike-malleable-c2-profiles
Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike and pyMalleableC2 to extract C2 indicators, detect evasion techniques, and generate network detection signatures.
24.6k · bundle
mukul975 analyzing-malware-sandbox-evasion-techniques
Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports.
24.6k · bundle
mukul975 analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, and protocol abuse for C2 and data exfiltration.
24.6k · bundle
mukul975 configuring-microsegmentation-for-zero-trust
Design and enforce microsegmentation policies using workload identity and label-based rules to prevent lateral movement in zero trust architectures, with guidance for tools like VMware NSX, Illumio, and Calico.
24.6k · bundle
mukul975 executing-active-directory-attack-simulation
Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise.
24.6k · bundle
mukul975 hunting-for-data-staging-before-exfiltration
Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.
24.6k · bundle
Frequently asked questions
What are Coding & Dev Tools agent skills?
Coding agent skills teach AI agents repeatable engineering workflows: reviewing pull requests, writing tests, refactoring safely, and enforcing house style. Install one SKILL.md and your agent applies the same checklist every time, whether you use Claude Code, Cursor, Codex, or another agent.
Which Coding & Dev Tools skills are most installed?
Popular Coding & Dev Tools skills on SkillMD right now include performing-deception-technology-deployment, analyzing-tls-certificate-transparency-logs, configuring-network-segmentation-with-vlans. Rankings shift as installs change; sort this page by "Most downloaded" for the live list.
Do Coding & Dev Tools skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds add <owner>/<name>, or copy the file into your agent's skills directory.