Medical Device Agent Skills
Modular "skill" files for AI coding agents working on medical device software. Each skill captures scoped, actionable guidance (requirements, patterns, anti-patterns, verification) to help agents produce safer, more compliant code without replacing human regulatory review.
What This Repo Is
- Curated guidance aligned to medical device standards (IEC 62304, ISO 14971, FDA, EU MDR)
- Machine-readable and agent-friendly (consistent schema, metadata, prerequisites)
- Code-focused with patterns, anti-patterns, and verification checklists
Target Audience
- Device Engineers — Embedded, connectivity, cloud developers building medical software
- QA/RA Engineers — Quality and regulatory pros collaborating with AI-assisted development
- Tool Builders — Integrating domain skills into Copilot, Claude, Cursor, or custom agents
Install
Choose either the shared installer (individual skills) or a native plugin (the full collection). Avoid installing both, which can show duplicate skills.
One command for Claude Code, Codex, and Cursor
Requires Node.js and npm. Run from the project where you want the skills:
npx skills add AminAlam/meddev-agent-skills -a claude-code -a codex -a cursor
Select skills interactively. Add -g to install across your projects. Preview available skills:
npx skills add AminAlam/meddev-agent-skills --list
For example, install the lifecycle hub and its risk-management prerequisite:
npx skills add AminAlam/meddev-agent-skills --skill meddev-iec-62304 --skill meddev-iso-14971 -a claude-code -a codex -a cursor
Claude Code plugin
Run inside Claude Code:
/plugin marketplace add AminAlam/meddev-agent-skills
/plugin install meddev-agent-skills@meddev-agent-skills
Restart the session if the skills do not appear. Invoke a skill with /meddev-agent-skills:meddev-iec-62304 or describe the relevant task.
Codex plugin
With a current Codex CLI:
codex plugin marketplace add AminAlam/meddev-agent-skills
codex plugin add meddev-agent-skills@meddev-agent-skills
Restart Codex after installation. In desktop versions with a Plugins directory, select Medical Device Agent Skills as the marketplace source and install the plugin. If your version does not provide these plugin commands, use the shared installer above. Invoke an installed skill with $meddev-iec-62304 or describe the relevant task.
Cursor plugin
Open Customize → From GitHub Repository and enter:
https://github.com/AminAlam/meddev-agent-skills
Install meddev-agent-skills from the imported marketplace. The skills appear in Customize. If your Cursor version does not offer repository import, use the shared installer above.
Use and update
Ask, for example: “Use the IEC 62304 lifecycle skill to review our software development plan.” Skills are selected by their descriptions; installing the collection does not load every skill body into each conversation.
The full plugin includes all prerequisites. When installing selected skills, also select the prerequisites listed in each skill's metadata.prerequisites; native tools do not automatically resolve those custom IDs. The skill catalog maps IDs to installable names.
Update shared-installer skills with npx skills update. For native plugins, refresh the marketplace and use the tool's plugin update controls. Maintainers should increment the plugin version when releasing changes.
Sources: Skills CLI, Claude Code marketplaces, Codex plugins, Cursor repository installation.
Quick Start
- Install relevant skills or the full plugin using one route above.
- Select guidance by domain, jurisdiction, and safety class.
- Follow the verification checklist when writing or reviewing code.
- Maintain traceability: Requirements → Design → Code → Tests.
- Reference
examples/for patterns with annotations.
For custom integrations and metadata filtering, see Agent Integration. For publication and local checks, see Distribution.
Skill Index
Regulatory
| Skill | Description |
|---|---|
| IEC 62304 | Software lifecycle hub by class (A/B/C); Clauses 4–9 |
| IEC 62304 Software Risk | Clause 7 software risk management process |
| IEC 62304 Legacy Software | Amendment A1 legacy software pathway (4.4) |
| ISO 14971 | Risk management integration, hazard controls, traceability |
| FDA Premarket | Submission software documentation, SBOM, cybersecurity |
| FDA 820 Design Controls | 21 CFR 820.30, DHF, verification vs validation, ISO 13485 slice |
| EU MDR | MDR-specific software expectations and Rule 11 |
| IEC 62366 Usability | Formative/summative evaluation, use-related risk, UI verification |
| SaMD Clinical Evaluation | Intended use, IMDRF category, clinical evidence, CER linkage |
| AI/ML Device Software | GMLP, data governance, PCCP, drift monitoring, model SOUP |
| Postmarket & Labeling | Complaints, vigilance, recalls/FSCA, IFU and on-device labeling |
| IEC 62443 | Industrial cybersecurity for connected devices |
| 21 CFR Part 11 | Electronic records/signatures, audit trails |
Architecture
| Skill | Description |
|---|---|
| Safety Classification | Applying class to architecture, segregation, testing |
| Separation of Concerns | Partitioning safety-critical boundaries |
| State Machines | Safe states, transitions, testing patterns |
| Fault Tolerance | Detection, degradation, watchdog, recovery |
| Defensive Design | Input/output validation, assertions, error handling |
Firmware
| Skill | Description |
|---|---|
| Embedded C | MISRA-C aligned embedded guidance and examples |
| Embedded C++ | Controlled C++ feature set for devices |
| RTOS Patterns | Tasks, priorities, IPC, timing, inversion avoidance |
| Memory Management | Static allocation, pools, MPU usage |
| Power Management | Sleep/wake, battery monitoring, graceful shutdown |
| Interrupt Handling | ISR structure, critical sections, testing |
| Hardware Abstraction | HAL layering and testability |
Connectivity
| Skill | Description |
|---|---|
| BLE Medical | Secure BLE services for PHI-bearing devices |
| WiFi Medical | WPA3/enterprise, cert management, coexistence |
| USB Medical | Class selection, enumeration, safety |
| Interoperability | HL7 FHIR/IHE, terminology, API design |
Security
| Skill | Description |
|---|---|
| Authentication | User/device auth, sessions, RBAC |
| Encryption | Algorithms, KDFs, data at rest/in transit |
| Secure Boot | Boot chain, signatures, rollback protection |
| Secure OTA | Signed updates, atomicity, rollback, server hardening |
| Key Management | Generation, storage, rotation, revocation |
| Threat Modeling | STRIDE, attack surface, control mapping |
Testing
| Skill | Description |
|---|---|
| Unit Testing | Frameworks, coverage by class, embedded mocks |
| Integration Testing | HW/SW integration, interfaces, environments |
| Static Analysis | Tools, MISRA configs, triage workflow |
| Dynamic Analysis | Runtime checks, thread safety, profiling |
| Fuzz Testing | Inputs/protocol fuzzing, crashes, security focus |
| Code Coverage | Metrics (stmt/branch/MC/DC), CI integration |
| Hardware-in-Loop | Fixtures, automation, timing, parallelism |
Documentation
| Skill | Description |
|---|---|
| Code Comments | Traceability annotations, risk/test tags |
| Design Docs | SAD/SDD, interfaces, SOUP docs (5.3–5.4) |
| Software Requirements | 5.2 requirements analysis and verification |
| Test Docs | Plans/protocols/reports, 5.7.5 and 9.8 records |
| Traceability | Matrices, bidirectional links, 7.3.3 hazard chain |
| Inline Docs | Intentful inline comments, trace tags, API notes |
| Change Control | Change requests, impact, approvals (8.2) |
| Software Configuration Mgmt | Clause 8 identification, baselines, history |
| Problem Resolution | Clause 9 problem reports, trends, closure |
| Software Maintenance | Clause 6 post-release maintenance process |
| AI-Assisted Dev Governance | LLM coding policy, review, CSA-style evidence for agent output |
Data
| Skill | Description |
|---|---|
| PHI Handling | PHI identification, de-ID, encryption, retention |
| Data Integrity | CRC/ECC, validation, storage/transit integrity |
| Audit Logging | What/how to log, protection, retention |
CI/CD
| Skill | Description |
|---|---|
| Pipeline Design | Regulated pipeline stages, artifacts, audit trail |
| Automated Testing | Strategy, hardware integration, flake handling |
| Release Management | Versioning, branches, verification, monitoring |
Disclaimer
These skills supplement, not replace, reading the actual standards and guidance. They paraphrase obligations by clause reference only and do not reproduce copyrighted standard text. Obtain and use your own licensed copies of IEC, ISO, FDA, and EU documents for authoritative review. Interpretations are noted; always verify with official documents and your QA/RA sign-off. Jurisdictional differences (FDA vs EU MDR) are called out where relevant.
Contributing
See CONTRIBUTING.md for how to propose or update skills. Quality requires citations to standards, runnable code examples, and verification criteria. Regulatory/domain expert review is required for merges.
License
MIT License — see LICENSE.