---
name: Awesome Agent Skills (Bundled — VoltAgent/awesome-agent-skills)
priority: 1
keywords: code, كود, coding, برمجة, agent, وكيل, skill creation, إنشاء مهارة, mcp, mcp server, integration, تكامل, security, أمان, framework, إطار عمل, react, next.js, fastapi, go, rust, deployment, نشر, observability, monitoring, مراقبة, sentry, datadog, terraform, cloudflare, supabase, vercel, stripe, github, ci, cd
---

# Awesome Agent Skills — Bundled In-Box (Source: VoltAgent/awesome-agent-skills)

> **Cite this skill before starting ANY coding project. It's the curated catalog of 1,100+ production-tested skills + the principles that make them work.**

## What this skill is

A curated directory of agent skills from real engineering teams (Anthropic, Google Labs, Vercel, Stripe, Cloudflare, Trail of Bits, Sentry, etc.) — **NOT AI-generated bulk content**. Use it as a "what skill should I install for this domain" reference + a meta-skill that teaches how to evaluate skills.

## Core philosophy

**Hand-picked, production-tested over mass-generated.** When a skill is needed for a domain, prefer:
1. Official maintainer skills (Anthropic, framework teams) FIRST
2. Trail of Bits / VoltAgent / Sentry / Stripe / Cloudflare for security/infra
3. Community skills with >100 stars + active maintenance LAST
4. **Never** trust AI-generated skill dumps for production code

## The 5 must-call-before-coding principles

### 1. Context-first design
Before generating ANY code, embed domain knowledge. Use the **anthropics/skill-creator** skill mentality:
- Understand the capability gap THIS code is filling
- Explicit scope boundaries (what this skill / module is NOT)
- Anti-pattern awareness encoded upfront

### 2. Explicit scope boundaries
Each skill targets a specific problem domain:
- `anthropics/skill-creator` — meta-skill for creating skills
- `anthropics/mcp-builder` — building MCP servers for API integration
- `anthropics/web-artifacts-builder` — HTML / React artifact generation
- `trailofbits/audit-context-building` — security architectural understanding before vuln analysis
- `getsentry/sentry-workflow` — end-to-end issue diagnosis

Don't blur boundaries. One skill = one focused domain.

### 3. Must-call-before-coding pattern
Trail of Bits skills enforce **deep architectural understanding before any vulnerability analysis**. Same principle for general coding:
- Run `gsd-map-codebase` (or equivalent) on existing code BEFORE writing new
- Marketing skills require defining target avatar BEFORE writing copy
- Apply this universally: research / context / scope come BEFORE code

### 4. Specification over assumption
The **trailofbits/ask-questions-if-underspecified** skill mandates clarification on ambiguous requirements. Universal principle: when the brief has gray areas (data shape, error handling, edge cases), ASK before guessing.

### 5. Anti-pattern awareness
Skills should encode common mistakes:
- `insecure-defaults` — detecting hardcoded secrets, missing CSP
- `generic-language-killer` — removing vague corporate language
- `performance-diagnosis` — root cause for campaign / endpoint underperformance

## Domain-specific best practices (must use)

### Security-first
Trail of Bits patterns:
- Threat modeling before code review
- Constant-time analysis for crypto code
- Property-based testing for invariants
- `insecure-defaults` scan after every PR

### Framework-specific
- **Next.js**: `vercel-labs/next-best-practices` — caching, ISR, middleware patterns
- **React Native**: `callstackincubator/react-native-best-practices` — distinct from web React (memory, native modules)
- **Stripe**: `stripe/stripe-upgrade-patterns` — versioned API migrations
- **Figma**: Code Connect / component mapping for design fidelity

### Infrastructure-as-code
HashiCorp + Cloudflare patterns:
- Terraform validation BEFORE apply
- Cloudflare Workers patterns for edge code
- Deny-by-default network policies

### Observability-first
Sentry / Datadog / Azure Monitor:
- **Instrument BEFORE production issues**, not after
- Structured logging with trace context propagation
- SLO definition before deployment

### Design-system compliance
Figma Code Connect:
- Component → code mapping enforced at PR time
- No "free-form creativity" on design-system surfaces

## Pre-coding checklist (must run BEFORE any code generation)

1. ✅ Validated this is from an official maintainer or trusted source
2. ✅ Prerequisite context skills checked (triage / authentication / configuration)
3. ✅ Embedded best practices + anti-patterns reviewed for the domain
4. ✅ Skill supports bidirectional feedback (asks questions, validates, iterates)
5. ✅ Compatible with target platform (Claude Code, Cursor, Gemini CLI, Muassis brain)

## Anti-patterns the catalog rejects

- ❌ **Bulk AI generation** — repository explicitly rejects this
- ❌ **Generic tooling** without domain-specific tribal knowledge
- ❌ **Silent failures** in workflows
- ❌ **Underspecified requirements** → universally apply ask-questions-if-underspecified

## Output discipline

When the agent is about to write code:
1. Cite: "🧰 سأستخدم مهارة `Awesome Agent Skills` للرد."
2. State which domain skills apply (e.g., "this is a Next.js task → applying `vercel-labs/next-best-practices`")
3. Run the 5-step pre-coding checklist
4. If under-specified → ask 1-3 sharp questions BEFORE writing code
5. Cite specific embedded skills as context for the work

## License
MIT. Source: https://github.com/VoltAgent/awesome-agent-skills — bundled in Muassis with attribution.
