Modular "skill" files for AI coding agents working on medical device software. Each skill captures scoped, actionable guidance (requirements, patterns, anti-patterns, verification) to help agents produce safer, more compliant code without replacing human regulatory review.
- Curated guidance aligned to medical device standards (IEC 62304, ISO 14971, FDA, EU MDR)
- Machine-readable and agent-friendly (consistent schema, metadata, prerequisites)
- Code-focused with patterns, anti-patterns, and verification checklists
- Device Engineers — Embedded, connectivity, cloud developers building medical software
- QA/RA Engineers — Quality and regulatory pros collaborating with AI-assisted development
- Tool Builders — Integrating domain skills into Copilot, Claude, Cursor, or custom agents
- Pick relevant skills by domain and jurisdiction (e.g.,
regulatory/iec-62304,security/secure-boot) - Load skills into your agent context — start with
SKILL_SCHEMA.md, then add specific skills - Follow the verification checklist when writing/reviewing code
- Maintain traceability: Requirements -> Design -> Code -> Tests
- Reference
examples/for real patterns with annotations
Claude / Cursor / Copilot: Load relevant SKILL.md files into context; include the schema first.
Retrieval (RAG): Index by metadata (skill_id, jurisdiction, applies_to) for similarity search.
Custom Agents: Implement prerequisite chaining from YAML frontmatter; filter by class/jurisdiction.
| Skill | Description |
|---|---|
| IEC 62304 | Software lifecycle process controls by class (A/B/C) |
| ISO 14971 | Risk management integration, hazard controls, traceability |
| FDA Premarket | Submission software documentation, SBOM, cybersecurity |
| FDA 820 Design Controls | 21 CFR 820.30, DHF, verification vs validation, ISO 13485 slice |
| EU MDR | MDR-specific software expectations and Rule 11 |
| IEC 62366 Usability | Formative/summative evaluation, use-related risk, UI verification |
| SaMD Clinical Evaluation | Intended use, IMDRF category, clinical evidence, CER linkage |
| AI/ML Device Software | GMLP, data governance, PCCP, drift monitoring, model SOUP |
| Postmarket & Labeling | Complaints, vigilance, recalls/FSCA, IFU and on-device labeling |
| IEC 62443 | Industrial cybersecurity for connected devices |
| 21 CFR Part 11 | Electronic records/signatures, audit trails |
| Skill | Description |
|---|---|
| Safety Classification | Applying class to architecture, segregation, testing |
| Separation of Concerns | Partitioning safety-critical boundaries |
| State Machines | Safe states, transitions, testing patterns |
| Fault Tolerance | Detection, degradation, watchdog, recovery |
| Defensive Design | Input/output validation, assertions, error handling |
| Skill | Description |
|---|---|
| Embedded C | MISRA-C aligned embedded guidance and examples |
| Embedded C++ | Controlled C++ feature set for devices |
| RTOS Patterns | Tasks, priorities, IPC, timing, inversion avoidance |
| Memory Management | Static allocation, pools, MPU usage |
| Power Management | Sleep/wake, battery monitoring, graceful shutdown |
| Interrupt Handling | ISR structure, critical sections, testing |
| Hardware Abstraction | HAL layering and testability |
| Skill | Description |
|---|---|
| BLE Medical | Secure BLE services for PHI-bearing devices |
| WiFi Medical | WPA3/enterprise, cert management, coexistence |
| USB Medical | Class selection, enumeration, safety |
| Interoperability | HL7 FHIR/IHE, terminology, API design |
| Skill | Description |
|---|---|
| Authentication | User/device auth, sessions, RBAC |
| Encryption | Algorithms, KDFs, data at rest/in transit |
| Secure Boot | Boot chain, signatures, rollback protection |
| Secure OTA | Signed updates, atomicity, rollback, server hardening |
| Key Management | Generation, storage, rotation, revocation |
| Threat Modeling | STRIDE, attack surface, control mapping |
| Skill | Description |
|---|---|
| Unit Testing | Frameworks, coverage by class, embedded mocks |
| Integration Testing | HW/SW integration, interfaces, environments |
| Static Analysis | Tools, MISRA configs, triage workflow |
| Dynamic Analysis | Runtime checks, thread safety, profiling |
| Fuzz Testing | Inputs/protocol fuzzing, crashes, security focus |
| Code Coverage | Metrics (stmt/branch/MC/DC), CI integration |
| Hardware-in-Loop | Fixtures, automation, timing, parallelism |
| Skill | Description |
|---|---|
| Code Comments | Traceability annotations, risk/test tags |
| Design Docs | SAD/SDD, interfaces, SOUP docs |
| Test Docs | Plans/protocols/reports, submission formatting |
| Traceability | Matrices, bidirectional links, tool integration |
| Inline Docs | Intentful inline comments, trace tags, API notes |
| Change Control | Change requests, impact, regression, config mgmt |
| AI-Assisted Dev Governance | LLM coding policy, review, CSA-style evidence for agent output |
| Skill | Description |
|---|---|
| PHI Handling | PHI identification, de-ID, encryption, retention |
| Data Integrity | CRC/ECC, validation, storage/transit integrity |
| Audit Logging | What/how to log, protection, retention |
| Skill | Description |
|---|---|
| Pipeline Design | Regulated pipeline stages, artifacts, audit trail |
| Automated Testing | Strategy, hardware integration, flake handling |
| Release Management | Versioning, branches, verification, monitoring |
These skills supplement, not replace, reading the actual standards and guidance. Interpretations are noted; always verify with official documents and your QA/RA function. Jurisdictional differences (FDA vs EU MDR) are called out where relevant.
See CONTRIBUTING.md for how to propose or update skills. Quality requires citations to standards, runnable code examples, and verification criteria. Regulatory/domain expert review is required for merges.
MIT License — see LICENSE.