gstack: Garry Tan's Claude Code skills, what they do and how to install

• Sends your request to the right gstack skill, or answers directly

  The root skill. It reads your request and routes it: testing to /qa, page work to /browse, new ideas to /office-hours, bugs to /investigate. By default it only auto-runs the four core skills (/office-hours, /review, /qa, /ship).

  Try: “which gstack skill should I use for this?”

  Runs code · gstack (router)

• Questions your product idea and writes a design doc before any code

  Start here. Six forcing questions modeled on YC office hours, pushes back on your framing, challenges premises, proposes implementation options with effort estimates, then writes a design doc the later skills read.

  Try: “I want to build a daily briefing app for my calendar. /office-hours”

  Write · /office-hours

• Rethinks scope as a founder would: expand, hold, or cut

  Reads the design doc and challenges scope to find the better product inside the request. Four modes: Expansion, Selective Expansion, Hold Scope, Reduction.

  Try: “/plan-ceo-review”

  Write · /plan-ceo-review

• Locks architecture, data flow, edge cases and the test plan

  Engineering-manager review of a plan: diagrams for data flow and state, failure modes, security concerns and a test matrix that /qa later uses.

  Try: “/plan-eng-review”

  Write · /plan-eng-review

• Scores a plan's design or developer experience and edits it up

  Design review rates each dimension 0 to 10 and edits the plan toward a 10, flagging AI slop. DX review walks developer personas, time to hello world and friction points.

  Write · /plan-design-review and /plan-devex-review

• Runs CEO, design, DX and eng reviews on a plan in one go

  One command for a fully reviewed plan. Runs the plan reviews in order (eng last) and only asks you about taste decisions.

  Try: “/autoplan”

  Write · /autoplan

• Builds a design system, mockup options, then working HTML

  Design-consultation writes DESIGN.md. Design-shotgun generates 4 to 6 AI mockups and a comparison board in your browser. Design-html turns the chosen mockup into production HTML for React, Svelte or Vue.

  Runs code · /design-consultation, /design-shotgun, /design-html

• Audits a live UI and fixes what it finds, with screenshots

  Same audit as the plan design review, applied to the running product, then fixes issues in atomic commits with before and after screenshots.

  Runs code · /design-review

• Finds bugs that pass CI but break in production, fixes the obvious ones

  Staff-engineer review of your branch diff. Auto-fixes clear issues, asks about risky ones, and names every weakened test or suppression for a human.

  Try: “/review”

  Runs code · /review

• Root-cause debugging: no fix without an investigation first

  Traces data flow and tests hypotheses before changing code, freezes edits to the module under study, and stops after three failed fixes.

  Runs code · /investigate

• Runs your typecheck, lint, build and tests until green

  Runs the repo's own checks and the tests /ship would pick, fixes what breaks, repeats, then hands off to /ship. Asks once before running repo commands.

  Runs code · /verify

• Tests your app in a real browser (or API/CLI), fixes bugs, adds tests

  QA lead: explores browser, API, CLI, job and webhook behavior, reproduces bugs, writes failing regression tests, fixes the cause and re-checks before committing.

  Try: “/qa https://staging.myapp.com”

  Runs code · /qa

• Same testing as /qa, but only reports bugs, changes nothing

  Explores and reports with replayable evidence and suggested regression cases, without touching product code or tests.

  Runs code · /qa-only

• Syncs main, runs tests and review, then pushes and opens the PR

  Release engineer: sync main, run tests, audit coverage and docs, verify, push and open a pull request.

  Try: “/ship”

  Runs code · /ship

• Merges the PR, waits for CI and deploy, checks production

  Takes an approved PR to verified in production. /setup-deploy is the one-time step that detects your platform, URL and deploy commands.

  Runs code · /land-and-deploy and /setup-deploy

• Watches a deploy for errors; measures page speed before and after

  Canary loops after a deploy watching console errors, slowdowns and page failures. Benchmark records load times, Core Web Vitals and resource sizes per PR.

  Runs code · /canary and /benchmark

• Security audit of your code: OWASP and STRIDE with challenged findings

  Chief security officer audit. Static assessment always; with Docker and a native toolchain it can run contained scanners and suggest fixes for Node/Bun, Python and Rails.

  Runs code · /cso

• Keeps docs in step with each release; writes missing docs

  Document-release checks changed behavior against your docs on every ship and fixes drift. Document-generate writes missing reference, how-to and tutorial docs from the code.

  Write · /document-release and /document-generate

• Weekly retro: per-person shipping, streaks and test health

  Team-aware weekly retrospective. /retro global covers all your projects and AI tools.

  Read · /retro

• Lets the agent open pages, click, screenshot and pull data

  Drives the Aside browser on macOS with your logged-in sessions, or gstack's own Chromium. Scrape extracts tables and prices; open-gstack-browser shows the browser with a sidebar agent.

  Runs code · /browse, /scrape, /open-gstack-browser

• Copies your browser cookies in; shares the browser with another agent

  Cookie import copies chosen cookies from Chrome, Brave, Edge, Arc and others into gstack's browser. Pair-agent gives another AI agent its own tab, optionally over an ngrok tunnel.

  Network · /setup-browser-cookies and /pair-agent

• Gets a second opinion review from the other vendor's agent

  Sends the diff or plan to OpenAI Codex (from Claude Code) or Claude Code (from Codex) for review, challenge or consultation, using your own login.

  Runs code · /codex and /claude-code

• Warns before destructive commands and locks edits to one folder

  Careful warns before rm -rf, DROP TABLE or force-push and hard-denies the worst. Freeze restricts edits to one directory; guard does both; unfreeze lifts the lock. Enforced by hooks only in Claude Code.

  Try: “be careful”

  Read · /careful, /freeze, /guard, /unfreeze

• Writes specs, keeps project learnings, makes PDFs and diagrams

  Spec turns vague intent into a filed issue. Learn manages what gstack remembers about your codebase. Make-pdf turns Markdown into PDF, HTML or Word. Diagram makes mermaid and excalidraw diagrams.

  Write · /spec, /learn, /make-pdf, /diagram

• Updates gstack; checks the install and prints fixes

  Gstack-upgrade updates every install it registered. ~/.claude/skills/gstack/bin/gstack-doctor checks Bun, hooks, binaries and Codex and prints the fix for each problem.

  Runs code · /gstack-upgrade and gstack-doctor

• iOS device QA, memory via GBrain, multi-agent control, remote runs

  /ios-qa and siblings test real iPhones over USB; /setup-gbrain and /sync-gbrain add a persistent knowledge base; /captain runs many agents; /ubicloud runs heavy jobs on a VM; /eval-plan prices evals.

  Runs code · Other skills (iOS, GBrain, Captain, Ubicloud, evals)

Watch out for

• skills.sh: Socket warn (53 alerts)

  Low and medium alerts, mostly test fixtures with deliberate bugs, plus browser JS eval, fingerprint spoofing and shell eval in helper scripts. No malware reported. skills.sh

• Setup changes your Claude Code settings

  ./setup builds browse, design and pdf programs with Bun and registers hooks in ~/.claude/settings.json. gstack-uninstall removes the skills, links, hooks and local state. github.com

• skills.sh: Snyk warn

  Status warn with risk level unknown. The listing shows no specific finding. skills.sh

• skills.sh: Gen Agent Trust Hub pass

  Rated safe. Notes heavy Bash use, a consent-gated ngrok tunnel in /pair-agent, Bun and Chromium downloads, and sudo for fonts in /make-pdf on Linux. skills.sh

Security advisories

In their words