Skip to content

aminalam/meddev-agent-skills

v1.0.0MIT

Medical device software skills for lifecycle planning, risk management, firmware, security, testing, and traceability.

Medical Device Agent Skills

Skills License IEC 62304

Modular "skill" files for AI coding agents working on medical device software. Each skill captures scoped, actionable guidance (requirements, patterns, anti-patterns, verification) to help agents produce safer, more compliant code without replacing human regulatory review.


What This Repo Is

  • Curated guidance aligned to medical device standards (IEC 62304, ISO 14971, FDA, EU MDR)
  • Machine-readable and agent-friendly (consistent schema, metadata, prerequisites)
  • Code-focused with patterns, anti-patterns, and verification checklists

Target Audience

  • Device Engineers — Embedded, connectivity, cloud developers building medical software
  • QA/RA Engineers — Quality and regulatory pros collaborating with AI-assisted development
  • Tool Builders — Integrating domain skills into Copilot, Claude, Cursor, or custom agents

Install

Choose either the shared installer (individual skills) or a native plugin (the full collection). Avoid installing both, which can show duplicate skills.

One command for Claude Code, Codex, and Cursor

Requires Node.js and npm. Run from the project where you want the skills:

npx skills add AminAlam/meddev-agent-skills -a claude-code -a codex -a cursor

Select skills interactively. Add -g to install across your projects. Preview available skills:

npx skills add AminAlam/meddev-agent-skills --list

For example, install the lifecycle hub and its risk-management prerequisite:

npx skills add AminAlam/meddev-agent-skills --skill meddev-iec-62304 --skill meddev-iso-14971 -a claude-code -a codex -a cursor

Claude Code plugin

Run inside Claude Code:

/plugin marketplace add AminAlam/meddev-agent-skills
/plugin install meddev-agent-skills@meddev-agent-skills

Restart the session if the skills do not appear. Invoke a skill with /meddev-agent-skills:meddev-iec-62304 or describe the relevant task.

Codex plugin

With a current Codex CLI:

codex plugin marketplace add AminAlam/meddev-agent-skills
codex plugin add meddev-agent-skills@meddev-agent-skills

Restart Codex after installation. In desktop versions with a Plugins directory, select Medical Device Agent Skills as the marketplace source and install the plugin. If your version does not provide these plugin commands, use the shared installer above. Invoke an installed skill with $meddev-iec-62304 or describe the relevant task.

Cursor plugin

Open Customize → From GitHub Repository and enter:

https://github.com/AminAlam/meddev-agent-skills

Install meddev-agent-skills from the imported marketplace. The skills appear in Customize. If your Cursor version does not offer repository import, use the shared installer above.

Use and update

Ask, for example: “Use the IEC 62304 lifecycle skill to review our software development plan.” Skills are selected by their descriptions; installing the collection does not load every skill body into each conversation.

The full plugin includes all prerequisites. When installing selected skills, also select the prerequisites listed in each skill's metadata.prerequisites; native tools do not automatically resolve those custom IDs. The skill catalog maps IDs to installable names.

Update shared-installer skills with npx skills update. For native plugins, refresh the marketplace and use the tool's plugin update controls. Maintainers should increment the plugin version when releasing changes.

Sources: Skills CLI, Claude Code marketplaces, Codex plugins, Cursor repository installation.

Quick Start

  1. Install relevant skills or the full plugin using one route above.
  2. Select guidance by domain, jurisdiction, and safety class.
  3. Follow the verification checklist when writing or reviewing code.
  4. Maintain traceability: Requirements → Design → Code → Tests.
  5. Reference examples/ for patterns with annotations.

For custom integrations and metadata filtering, see Agent Integration. For publication and local checks, see Distribution.


Skill Index

Regulatory

SkillDescription
IEC 62304Software lifecycle hub by class (A/B/C); Clauses 4–9
IEC 62304 Software RiskClause 7 software risk management process
IEC 62304 Legacy SoftwareAmendment A1 legacy software pathway (4.4)
ISO 14971Risk management integration, hazard controls, traceability
FDA PremarketSubmission software documentation, SBOM, cybersecurity
FDA 820 Design Controls21 CFR 820.30, DHF, verification vs validation, ISO 13485 slice
EU MDRMDR-specific software expectations and Rule 11
IEC 62366 UsabilityFormative/summative evaluation, use-related risk, UI verification
SaMD Clinical EvaluationIntended use, IMDRF category, clinical evidence, CER linkage
AI/ML Device SoftwareGMLP, data governance, PCCP, drift monitoring, model SOUP
Postmarket & LabelingComplaints, vigilance, recalls/FSCA, IFU and on-device labeling
IEC 62443Industrial cybersecurity for connected devices
21 CFR Part 11Electronic records/signatures, audit trails

Architecture

SkillDescription
Safety ClassificationApplying class to architecture, segregation, testing
Separation of ConcernsPartitioning safety-critical boundaries
State MachinesSafe states, transitions, testing patterns
Fault ToleranceDetection, degradation, watchdog, recovery
Defensive DesignInput/output validation, assertions, error handling

Firmware

SkillDescription
Embedded CMISRA-C aligned embedded guidance and examples
Embedded C++Controlled C++ feature set for devices
RTOS PatternsTasks, priorities, IPC, timing, inversion avoidance
Memory ManagementStatic allocation, pools, MPU usage
Power ManagementSleep/wake, battery monitoring, graceful shutdown
Interrupt HandlingISR structure, critical sections, testing
Hardware AbstractionHAL layering and testability

Connectivity

SkillDescription
BLE MedicalSecure BLE services for PHI-bearing devices
WiFi MedicalWPA3/enterprise, cert management, coexistence
USB MedicalClass selection, enumeration, safety
InteroperabilityHL7 FHIR/IHE, terminology, API design

Security

SkillDescription
AuthenticationUser/device auth, sessions, RBAC
EncryptionAlgorithms, KDFs, data at rest/in transit
Secure BootBoot chain, signatures, rollback protection
Secure OTASigned updates, atomicity, rollback, server hardening
Key ManagementGeneration, storage, rotation, revocation
Threat ModelingSTRIDE, attack surface, control mapping

Testing

SkillDescription
Unit TestingFrameworks, coverage by class, embedded mocks
Integration TestingHW/SW integration, interfaces, environments
Static AnalysisTools, MISRA configs, triage workflow
Dynamic AnalysisRuntime checks, thread safety, profiling
Fuzz TestingInputs/protocol fuzzing, crashes, security focus
Code CoverageMetrics (stmt/branch/MC/DC), CI integration
Hardware-in-LoopFixtures, automation, timing, parallelism

Documentation

SkillDescription
Code CommentsTraceability annotations, risk/test tags
Design DocsSAD/SDD, interfaces, SOUP docs (5.3–5.4)
Software Requirements5.2 requirements analysis and verification
Test DocsPlans/protocols/reports, 5.7.5 and 9.8 records
TraceabilityMatrices, bidirectional links, 7.3.3 hazard chain
Inline DocsIntentful inline comments, trace tags, API notes
Change ControlChange requests, impact, approvals (8.2)
Software Configuration MgmtClause 8 identification, baselines, history
Problem ResolutionClause 9 problem reports, trends, closure
Software MaintenanceClause 6 post-release maintenance process
AI-Assisted Dev GovernanceLLM coding policy, review, CSA-style evidence for agent output

Data

SkillDescription
PHI HandlingPHI identification, de-ID, encryption, retention
Data IntegrityCRC/ECC, validation, storage/transit integrity
Audit LoggingWhat/how to log, protection, retention

CI/CD

SkillDescription
Pipeline DesignRegulated pipeline stages, artifacts, audit trail
Automated TestingStrategy, hardware integration, flake handling
Release ManagementVersioning, branches, verification, monitoring

Disclaimer

These skills supplement, not replace, reading the actual standards and guidance. They paraphrase obligations by clause reference only and do not reproduce copyrighted standard text. Obtain and use your own licensed copies of IEC, ISO, FDA, and EU documents for authoritative review. Interpretations are noted; always verify with official documents and your QA/RA sign-off. Jurisdictional differences (FDA vs EU MDR) are called out where relevant.

Contributing

See CONTRIBUTING.md for how to propose or update skills. Quality requires citations to standards, runnable code examples, and verification criteria. Regulatory/domain expert review is required for merges.

License

MIT License — see LICENSE.