Coding & Dev Tools Agent Skills
Coding agent skills teach AI agents repeatable engineering workflows: reviewing pull requests, writing tests, refactoring safely, and enforcing house style. Install one SKILL.md and your agent applies the same checklist every time, whether you use Claude Code, Cursor, Codex, or another agent.
Coding & Dev Tools
9,772 skills
akillness stitch-skills
Generates high-fidelity UI screens, multi-page websites, DESIGN.md documentation, and React components from natural-language prompts using the Stitch MCP server, with support for prompt refinement and walkthrough video creation via Remotion.
42 · bundle
shulkwisec xxe
Detect and exploit XML External Entity (XXE) injection vulnerabilities in XML parsers, including file disclosure, SSRF, and blind out-of-band exfiltration.
21
shulkwisec jwt-authentication-complete-deep-dive
Provides exact payloads and bypass techniques for every PortSwigger JWT authentication lab variant, from unverified signatures to algorithm confusion attacks.
21 · bundle
shulkwisec remediate
Generates specific, implementable fixes for each vulnerability finding, producing code patches, configuration changes, dependency updates, and IaC fixes with before/after code and verification steps.
21
shulkwisec websockets-deep-dive
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
21 · bundle
shulkwisec amsi-bypass
Bypass the Windows Antimalware Scan Interface (AMSI) using memory patching, reflection, and obfuscation techniques. Execute undetected PowerShell, VBScript, JScript, and .NET assemblies in-memory without triggering Microsoft Defender or third-party AV/EDR solutions. Use this skill during Red Team engagements when loading offensive tools (Mimikatz, Rubeus, SharpHound) in memory on defended Windows endpoints.
21 · bundle
shulkwisec clickjacking
Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive actions.
21
shulkwisec jwt-misconfig
JWT Misconfiguration
21
shulkwisec access-control-complete-deep-dive
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
21 · bundle
shulkwisec jndi-injection
JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().
21
shulkwisec shodan-dorking
Utilize Shodan, the search engine for Internet-connected devices, to discover exposed assets, vulnerable ports, default credentials, and specific infrastructure configurations using advanced search queries (dorks).
21 · bundle
shulkwisec xslt-injection
XSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces. Use when user-controlled XSLT/stylesheet input or transform endpoints are in scope.
21
shulkwisec web-cache-deception-deep-dive
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
21 · bundle
shulkwisec nosql-injection
NoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic abuse.
21
shulkwisec essential-skills-deep-dive
PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
21 · bundle
shulkwisec heap-exploitation
Heap exploitation playbook. Use when targeting ptmalloc2/glibc heap vulnerabilities including UAF, double free, overflow, off-by-one/null, and leveraging tcache/fastbin/unsortedbin attacks for arbitrary write or code execution.
21 · bundle
bobmatnyc clap
Build production Rust CLIs with Clap: subcommands, config layering, validation, exit codes, shell completions, and testable command surfaces
71 · bundle
bobmatnyc skill-creator
Guide for creating effective skills
71 · bundle
bobmatnyc internal-comms
Framework for writing concise 3P (Progress, Plans, Problems) team updates for executives and stakeholders
71 · bundle
bobmatnyc vb-core
Core VB.NET patterns, type safety, modern language features
71 · bundle
bobmatnyc gh-cli
Reliably drive the GitHub gh CLI for issue, PR, and label operations in automation and subagent environments, with pre-flight verification so you never fabricate a success or a fake issue URL.
71 · bundle
bobmatnyc asyncio
Python asyncio - Modern concurrent programming with async/await, event loops, tasks, coroutines, primitives, aiohttp, and FastAPI async patterns
71 · bundle
bobmatnyc axum
Axum (Rust) web framework patterns for production APIs: routers/extractors, state, middleware, error handling, tracing, graceful shutdown, and testing
71 · bundle
bobmatnyc tauri
Advanced Tauri event patterns for bidirectional communication, streaming data, window-to-window messaging, and custom event handling
71 · bundle
bobmatnyc bad-example-skill
ANTI-PATTERN - Example showing violations of self-containment (DO NOT COPY)
71 · bundle
bobmatnyc cargo-release
PM-invocable protocol for Cargo publish and release operations in the trusty-tools Rust monorepo: semver rules, 10-step release sequence, macOS codesign safety, and cross-crate dependency ordering
71 · bundle
bobmatnyc database-migration
Safe patterns for evolving database schemas in production with decision trees and troubleshooting guidance.
71 · bundle
bobmatnyc json-data-handling
Working effectively with JSON data structures.
71 · bundle
bobmatnyc example-framework-skill
Example of a properly self-contained skill following all best practices
71 · bundle
bobmatnyc biome
Biome - Fast all-in-one toolchain for web projects (linter + formatter in Rust, 100x faster than ESLint)
71 · bundle
bobmatnyc django
Build content-heavy web applications with a full-featured Python framework that includes ORM, admin interface, authentication, and REST API support.
71 · bundle
bobmatnyc stacked-prs
Create and manage stacked (dependent) pull requests for complex features
71 · bundle
bobmatnyc ecto-patterns
Ecto patterns for Phoenix/Elixir apps. Covers schemas, changesets, migrations, queries, Ecto.Multi, transactions, constraints, associations, pagination, tenant partitioning, performance, and testing.
71 · bundle
bobmatnyc vitest
Vitest - Modern TypeScript testing framework with Vite-native performance, ESM support, and TypeScript-first design
71 · bundle
bobmatnyc typescript-core
Advanced TypeScript patterns and best practices for 2025
71 · bundle
bobmatnyc brainstorming
Interactive idea refinement using Socratic method to develop fully-formed designs
71 · bundle
Frequently asked questions
What are Coding & Dev Tools agent skills?
Coding agent skills teach AI agents repeatable engineering workflows: reviewing pull requests, writing tests, refactoring safely, and enforcing house style. Install one SKILL.md and your agent applies the same checklist every time, whether you use Claude Code, Cursor, Codex, or another agent.
Which Coding & Dev Tools skills are most installed?
Popular Coding & Dev Tools skills on SkillMD right now include heap-exploitation, WebSockets — Deep Dive, amsi-bypass. Rankings shift as installs change; sort this page by "Most downloaded" for the live list.
Do Coding & Dev Tools skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds add <owner>/<name>, or copy the file into your agent's skills directory.