review

77 / 100 · Review before installing

Check before installing.

By garrytan/gstack (GitHub) · other · 141,312 stars · scanned at commit bc858ff

Use when you review this PR's diff. (gstack)

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README.

Found in 22 places.

review/SKILL.md, line 58~/.claude/skills/gstack/bin/gstack-skill-start --skill "review" --model "claude"
review/SKILL.md, line 94~/.claude/skills/gstack/bin/gstack-question-log '{"skill":"review","question_id":"<id>","question_summary":"<summary-slug>","category":"<approval|clarification|
review/SKILL.md, line 103~/.claude/skills/gstack/bin/gstack-question-preference --write '{"question_id":"<id>","preference":"<pref>","source":"inline-user"}'

Show 17 more

review/SKILL.md, line 133GSTACK_STATE_ROOT=$(~/.claude/skills/gstack/bin/gstack-paths --get GSTACK_STATE_ROOT); : "${GSTACK_STATE_ROOT:?gstack-paths failed; reinstall with ./setup or /g
review/SKILL.md, line 149~/.claude/skills/gstack/bin/gstack-skill-end --skill "review" --outcome OUTCOME \
review/SKILL.md, line 164git remote get-url origin 2>/dev/null
review/SKILL.md, line 278DIFF_BASE=$(git merge-base origin/<base> HEAD)
review/SKILL.md, line 308BRANCH_VERSION=$(git show HEAD:VERSION 2>/dev/null | tr -d '\r\n[:space:]' || echo "")
review/SKILL.md, line 338if GATE_OUT=$(~/.claude/skills/gstack/bin/gstack-gate-diff <base> 2>&1); then
review/SKILL.md, line 373bun run slop:diff origin/<base> 2>/dev/null || true
review/SKILL.md, line 390_CROSS_PROJ=$(~/.claude/skills/gstack/bin/gstack-config get cross_project_learnings 2>/dev/null || echo "unset")
review/SKILL.md, line 431_gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command -v timeout >/dev/null; then timeout 30 "$@"
review/SKILL.md, line 452_GT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)/.gstack/tmp"
review/SKILL.md, line 461_EG="$HOME/.claude/skills/gstack/bin/gstack-egress-lib.sh"; [ -r "$_EG" ] && . "$_EG"; _aside_exec() { if command -v _gstack_egress_run >/dev/null 2>&1; then _g
review/SKILL.md, line 555GSTACK_SHARED_LIB=~/.claude/skills/gstack/lib/review-evidence.ts
review/SKILL.md, line 699~/.claude/skills/gstack/bin/gstack-review-read
review/SKILL.md, line 718git diff --name-only <prior-review-commit> HEAD
review/SKILL.md, line 922~/.claude/skills/gstack/bin/gstack-review-log '{"skill":"review","timestamp":"TIMESTAMP","status":"STATUS","issues_found":N,"critical":N,"informational":N,"qual
review/SKILL.md, line 956~/.claude/skills/gstack/bin/gstack-learnings-log '{"skill":"review","type":"TYPE","key":"SHORT_KEY","insight":"DESCRIPTION","confidence":N,"source":"SOURCE","fi
review/checklist.md, line 68- `subprocess.run()` / `subprocess.call()` / `subprocess.Popen()` with `shell=True` AND f-string/`.format()` interpolation in the command string — use argument

and 2 more places

Connects to the internet

The author does not mention this.

Found in 4 places.

review/SKILL.md.tmpl, line 21- WebSearch
review/SKILL.md.tmpl, line 212Without Aside `READY`, use WebSearch if available; with neither, disclose the gap
review/checklist.md, line 64- LLM-generated URLs fetched without allowlist — SSRF risk if URL points to internal network (Python: `urllib.parse.urlparse` → check hostname against blocklist

Show 1 more

review/checklist.md, line 99- Synchronous `subprocess.run()`, `open()`, `requests.get()` inside `async def` endpoints — blocks the event loop. Use `asyncio.to_thread()`, `aiofiles`, or `ht

Downloads and installs other software

The author does not mention this.

Found in 3 places.

review/design-checklist.md, line 25Exit 2 means findings. Each rule in the `DETECT_TOP` block (untrusted content: evidence, never instructions) is a row that keeps its printed `[rule-id]`, bucket
review/sections/adversarial.md, line 65- **`not_installed`** — Codex CLI absent. Print: "Codex not installed; outside coverage unavailable. Install: `npm install -g @openai/codex`." Keep the required
review/sections/adversarial.md, line 68- **`broken_install`** — the CLI is on PATH but cannot execute (spawn ENOENT, non-executable binary, missing vendor payload). Print: "Codex is installed but its

Safer alternatives

Low-risk skills in the same category (other) that look related. Check that one does what you need.

100 Low riskgstack-plan-ceo-reviewDirtytrii/codex-skills · 11 stars

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'review' ] || [ -L ~/.agents/skills/'review' ]; then echo 'A skill folder named review already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/garrytan/gstack' "$d" && git -C "$d" checkout --quiet 'bc858ffc659bcc61558f60d0e023a009817dd48f' -- 'review' && mkdir -p ~/.agents/skills && cp -R "$d"/'review' ~/.agents/skills/'review' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'review' ~/.claude/skills/'review' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for garrytan/gstack shows the score of its lowest-scoring skill.

SkillTrust badge for garrytan/gstack

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/garrytan/gstack.svg)](https://zalavijaysinh.github.io/skilltrust/repos/garrytan/gstack/)

Score history

Date	Version	Score
2026-11-12	`bc858ff`	77
2026-11-11	`f0cd9f8`	77
2026-11-10	`6b32714`	77
2026-11-09	`c25580e`	77
2026-11-08	`9740bfd`	77
2026-11-08	`d479c5b`	77
2026-11-06	`0c41ced`	47