
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
developer-stack-skills
Advanced tools
AI agent SKILL.md files plus installer CLI for Java/Spring, Python/FastAPI, React/Angular, Testing, and Project Conventions. Compatible with Claude, Cline, Roocode, Copilot, and Cursor.
AI agent SKILL.md files for full-stack developers — Java, Python, React, Angular, Testing, and Project Conventions.
Compatible with Claude, Cline, Roocode, GitHub Copilot, and Cursor.
npm install developer-stack-skills
Global install:
npm install -g developer-stack-skills
Version in this README: 2.0.0
Interactive npm install can auto-run post-install configuration, but recent npm versions hide lifecycle script output by default. Treat configuration as explicit step after installation unless you install with --foreground-scripts.
npm install developer-stack-skills
Installs skills into <project>/.ai-skills/developer-stack-skills
Default mode prompt prefers copynpm install -g developer-stack-skills
Installs skills into ~/.ai-skills/developer-stack-skills
Default mode prompt prefers symlink
Post-install configure step: developer-stack-skills configureWhy global install still asks for project directory:
~/.ai-skills/developer-stack-skillsProject directory so it knows where to update CLAUDE.md, .clinerules, .roo/config.yml, .cursor/rules/developer-stack-skills.mdc, and .github/copilot-instructions.mdPost-install configure command:
developer-stack-skills configure
Shortcut:
developer-stack-skills
developer-stack-skills install
To force npm to show install-time prompts/logs:
npm install developer-stack-skills --foreground-scripts
npm install -g developer-stack-skills --foreground-scripts
Remove installed skills and agent config:
developer-stack-skills uninstall
Show version:
developer-stack-skills version
Show help:
developer-stack-skills help
Start MCP server (stdio):
developer-stack-skills serve
Or run from local package without global install:
npx developer-stack-skills configure
npx developer-stack-skills serve
Installer will:
all, claude, cursor, cline, roocode, or copilotcopy files or create symlinksource, local, or global), install scope, OS, source directory, install directory, and each generated config pathProject-level install dir:
<project>/.ai-skills/developer-stack-skills/
Global install dir:
~/.ai-skills/developer-stack-skills/
postinstall skips auto-config in non-interactive environments and in source checkout of this repo. npm also hides lifecycle script output by default unless --foreground-scripts is set. In those cases, run developer-stack-skills configure after installation.
Non-interactive install:
developer-stack-skills install --agent all --mode symlink --dir . --yes
developer-stack-skills uninstall --agent all --dir . --dry-run --yes
Example log output:
[developer-stack-skills] installing version 2.0.0
[developer-stack-skills] package install type: global
[developer-stack-skills] skill install scope: global
[developer-stack-skills] os: windows
[developer-stack-skills] package dir: C:\Users\<you>\AppData\Roaming\npm\node_modules\developer-stack-skills
[developer-stack-skills] project dir: D:\Projects\my-app
[developer-stack-skills] install dir: C:\Users\<you>\.ai-skills\developer-stack-skills
[developer-stack-skills] skill installed: java-spring -> C:\Users\<you>\.ai-skills\developer-stack-skills\java-spring
[developer-stack-skills] cline config updated: D:\Projects\my-app\.clinerules
[developer-stack-skills] install complete
Flags:
--agent <all|claude|cursor|cline|roocode|copilot>--mode <copy|symlink>--dir <project-directory>--dry-run--yesCommands:
configureinstalluninstallserveversionhelpSkills are exposed as MCP tools via stdio transport.
developer-stack-skills serve
Add to MCP client config:
{
"mcpServers": {
"developer-stack-skills": {
"command": "developer-stack-skills",
"args": ["serve"]
}
}
}
Or without global install:
{
"mcpServers": {
"developer-stack-skills": {
"command": "npx",
"args": ["developer-stack-skills", "serve"]
}
}
}
Available tools:
| Tool | Description |
|---|---|
list_available_skills | List all skills with descriptions and file patterns |
get_skill | Load full SKILL.md for a stack (java-spring, python-backend, frontend, testing, project-conventions) |
get_conventions | Load project-wide conventions (shortcut for get_skill with project-conventions) |
detect_stack | Given a file path, return which skill applies and a ready-to-use get_skill call |
Five slash commands are installed into your project:
| Command | Description |
|---|---|
/implement-feature [description] | Detect stack, plan, implement with tests |
/write-tests [target] | Write tests following stack conventions |
/review-pr | Review branch changes against conventions |
/check-deps | Audit dependencies for outdated versions and vulnerabilities |
/add-endpoint [description] | Add REST endpoint following stack and REST conventions |
Two Claude Code hooks fire automatically:
| Hook | File | Fires When |
|---|---|---|
pre-write | hooks/pre-write.js | Before any file write — injects stack reminder based on file extension |
pre-bash | hooks/pre-bash.js | Before bash commands — warns to verify latest stable version on package installs |
The pre-write hook covers: Java, Kotlin, Python, Angular TypeScript, generic TypeScript/JSX, .env files, and .sql migrations.
The pre-bash hook detects: pip install, uv add, npm install, yarn add, pnpm add, bun add, poetry add, and npx pkg@latest.
Skill files get copied or linked here:
<project>/.ai-skills/developer-stack-skills/
Or for global package installs:
~/.ai-skills/developer-stack-skills/
Agent configs get created or updated here:
Claude: CLAUDE.mdCursor: .cursor/rules/developer-stack-skills.mdcCline: .clinerulesRoocode: .roo/config.ymlGitHub Copilot: .github/copilot-instructions.mdNotes:
copy makes project-local copies of skill folderssymlink keeps installed skills linked to package sourcenpm install -g developer-stack-skills still ask for Project directory?Because installer does two different things:
With global package install, skill folders go to:
~/.ai-skills/developer-stack-skills/
But agent configs still must be written into a real project, for example:
D:\Projects\my-app\CLAUDE.md
D:\Projects\my-app\.clinerules
D:\Projects\my-app\.roo\config.yml
So Project directory prompt is still required. Global install means shared skill storage, not machine-wide auto-enable for every repository.
npm install -g developer-stack-skills and npm install developer-stack-skills?npm install -g developer-stack-skills
developer-stack-skills works anywhere~/.ai-skills/developer-stack-skills/symlinknpm install developer-stack-skills
node_modulesnpx developer-stack-skills or npm scripts<project>/.ai-skills/developer-stack-skills/copySame in both cases:
| Skill | File | Use When |
|---|---|---|
java-spring | java-spring/SKILL.md | Spring Boot, JPA, REST APIs, JUnit |
python-backend | python-backend/SKILL.md | FastAPI, SQLAlchemy, Pydantic, pytest |
frontend | frontend/SKILL.md | React, Angular, TypeScript, TanStack Query |
testing | testing/SKILL.md | Unit, integration, E2E across all stacks |
project-conventions | project-conventions/SKILL.md | Git, ADRs, naming, PR standards, README |
MIT
FAQs
AI agent SKILL.md files plus installer CLI for Java/Spring, Python/FastAPI, React/Angular, Testing, and Project Conventions. Compatible with Claude, Cline, Roocode, Copilot, and Cursor.
The npm package developer-stack-skills receives a total of 18 weekly downloads. As such, developer-stack-skills popularity was classified as not popular.
We found that developer-stack-skills demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.